Log huntUnit 4 · Topic 4.4
Auth log hunt: find the password attacks
Read a server authentication log and find the password attacks.
New to this? Read the topic first: 4.4 Detecting Attacks on Devices.
Simulation · [4.4.D.1, 4.4.D.2, 4.4.D.3, 4.4.D.4]
Auth log hunt: find the password attacks
You are a forensic analyst checking the authentication log of a factory's production server. Staff work 07:00 to 17:00 from the plant network 10.20.0.0/16. Most authentication logs record only the username; this server's security tool also records the user:password pair tried with a default account, so you can see credential stuffing directly. Tap every line that is an indicator of a password attack or a compromised password. There are 10.
-
Red flag. A default user:password pair at 2 a.m. from outside: the start of credential stuffing.
-
Red flag. Another default pair one second later from the same IP: credential stuffing.
-
Red flag. Default credentials tried in quick succession: credential stuffing.
-
Red flag. Many different users within seconds from one unusual IP address: password spraying.
-
Red flag. Password spraying continues: a different user, same IP, one second later.
-
Red flag. Password spraying: yet another account tried from the same address within seconds.
-
Red flag. One user, many wrong passwords in seconds: an online password attack on a single account.
-
Red flag. The same user failing again one second later: online password attack.
-
Red flag. A third failure in three seconds for one account: online password attack.
-
Red flag. A successful login at 4 a.m. from an outside IP: an indicator that d.novak's password may be compromised.
-
Fine. One failure at the start of the shift from the plant network, followed by a success seven seconds later: a mistyped password, not an attack.
-
Fine. A staff member at the start of the shift, from the plant network. Normal.
-
Fine. Normal hours, plant network. Fine.
Go to the topic: 4.4 Detecting Attacks on Devices