Review firewall logs for repeated connection attempts, especially from a single source IP. Failed Windows login auditing events can also signal attacks.