Run a honeypot in a VM for a few weeks. https://www.honeynet.org/projects/ https://www.honeynet.org/projects/ You leave a small enticing ssh listener which is

Run a honeypot in a VM for a few weeks. https://www.honeynet.org/projects/ https://www.honeynet.org/projects/ You leave a small enticing ssh listener which is actually a Python or similar daemon process that fakes its output and logs usernames and password attempts. Obviously that thing is on its own DMZ with no outbound access. You can harvest the latest crop of usernames and passwords that the baddies are using with a little bit of effort, but not much! You can also slow them down a bit with a sprinkle of tarpitting. Take that list and use it as a password blacklist for your own systems. You might allow the list to decay by say six months after the last sighting to avoid it getting too big. Actually you could allow decay with a normally distributed six month spread, centred over one year to avoid predictability. That may be going too far - once a password is on the list, I suggest you keep it. Usernames that are not simply given names is a very good idea. Service accounts should not be able to login interactively if they don't need it (set your RDP groups up properly, PLEASE!) Give service accounts odd names and sha1sum style passwords. Administrator, Administrateur, Administrador etc should not be able to login at all to anything and nor should root. Those four names come up in my logs so often, it isn't funny. If you've got an account called sql or ldap or mail or similar, then get rid of it. Please.