Brute-force login attempts playbook

1. 1. Count the failures and the usernamesMany failures in a short time, especially across several usernames like admin, root and test, means automated guessing.
2. 2. Look at the sourceIs the address internal or external? Do we know it? Check its reputation with the Intel lookup.
3. 3. Was there a success?Look for an Accepted or success line from the same address. A success after a burst of failures means the attacker may be in.
4. 4. See what the account did nextCheck commands, downloads and new connections right after the login. Hands-on activity such as running curl with elevated rights is a major red flag.
5. 5. Rule out an ordinary mistakeA real user who forgot a password makes a few attempts for one account from a known address, not dozens across many names.
6. 6. ContainBlock the source address, disable or reset the account, and check whether the same address touched other hosts.

Tools you will use

Practice with this playbook

• SL-1003Authentication: multiple failures followed by success (SSH)high
• SL-1018Account lockout: excessive failed sign-inslow
• SL-1025Password spray detected: failed sign-ins across many accounts from one IPmedium