What breaks. How Asteria answers.

Exposed RDP & SSH — credential stuffing

The failure: Brute-force and stuffing against internet-facing remote access. Even with lockout policies, noise and eventual success remain common.

Asteria’s answer: Decoy RDP/SSH listeners capture every attempt (source IP, credentials on bait). Premium auto-block and operator-driven AR-BLOCK firewall rules cut off sources before they pivot to the real service.

You still should: Keep real RDP behind VPN/bastion where possible; Asteria adds a loud false door, not a license to leave admin ports open forever.

MSSQL, MySQL & FTP probing

The failure: Scanners hunt open data and file ports. Opening production DBs to the internet “temporarily” becomes permanent.

Asteria’s answer: Fake listeners attract the same scanners. You see who knocked and when — without exposing real schemas or file shares on those ports.

Operator tip: Document which decoy ports are intentional so monitoring teams don’t treat them as misconfigurations.

Ransomware staging

The failure: Before encryption, attackers touch canaries, abuse shadow copies, or mass-touch files. By the time the ransom note appears, it’s late.

Asteria’s answer: Canary files and shadow-copy abuse heuristics escalate to urgent threat alerts so you can isolate the host while encryption is still a plan.

Pair with: Backups, EDR, and offline recovery drills — deception buys time; it doesn’t replace restore capability.

Post-compromise lateral movement

The failure: After one foothold, attackers seek “interesting” services — admin shares, SQL, RDP to jump hosts.

Asteria’s answer: Attractive decoys waste time and generate high-fidelity signals. From the cloud (Premium) you can log off sessions, terminate processes, and push block rules without VPN’ing to every box at 2 a.m.

Ops reality & MSP fleets

The failure: Alerts fire, but the person on-call can’t reach the host quickly. Or you manage dozens of Windows boxes with uneven tooling — stack rebuilds (Winsock, firewall mess, patch loops) still need hands on the box.

Asteria’s answer: One membership, linked agents, cloud timeline + remote desktop + Tools & Repair toolkit. Threat intel bundles push IoCs to the fleet. Standard for overview; Premium seats where traps and remote actions matter.

What Asteria does not claim

• It does not stop zero-days inside legitimate apps by magic
• It does not replace patching, least privilege, or backup discipline
• It does not make intentionally exposed production RDP “safe”

It raises the cost of probing your Windows estate and shortens the path from “something weird” to “blocked and reviewed.”