{"id":3933,"date":"2026-11-05T07:06:19","date_gmt":"2026-11-05T15:06:19","guid":{"rendered":"https:\/\/cyber.mag212.com\/?page_id=3933"},"modified":"2026-11-05T07:06:19","modified_gmt":"2026-11-05T15:06:19","slug":"brute-force-log-analysis","status":"publish","type":"page","link":"https:\/\/cyber.mag212.com\/fr\/learn\/brute-force-log-analysis\/","title":{"rendered":"Catch a Brute-Force Attack in the Logs (Free Lab)"},"content":{"rendered":"\n<div class=\"m212x\" id=\"m212-log-lab\">\n<style>\n.m212x{--bg:#0a0f15;--panel:#0f1720;--panel2:#121c27;--line:#1f2d3a;--line2:#2a3b4b;--ink:#e6edf3;--mute:#9fb0c0;--green:#3ee6a0;--red:#ff5468;--cyan:#3cc8f0;--amber:#f6b544;--violet:#a98bff;\n font-family:Inter,system-ui,-apple-system,\"Segoe UI\",sans-serif;color:var(--ink);line-height:1.6;font-size:16px}\n.m212x *{box-sizing:border-box}\n.m212x h2,.m212x h3,.m212x h4,.m212x p,.m212x ul,.m212x ol{margin:0}\n.m212x a{color:var(--cyan)}\n.m212x .hero{position:relative;background:radial-gradient(ellipse at 90% 0%,rgba(60,200,240,.14),transparent 60%),var(--bg);border:1px solid var(--line);border-radius:14px;padding:34px 30px;overflow:hidden;margin-bottom:22px}\n.m212x .hero::before{content:\"\";position:absolute;left:0;right:0;top:0;height:4px;background:linear-gradient(90deg,var(--green),var(--cyan) 60%,var(--red))}\n.m212x .kick{font-size:12px;font-weight:800;letter-spacing:.2em;text-transform:uppercase;color:var(--cyan);margin-bottom:8px}\n.m212x .hero h2{font-size:clamp(26px,4.6vw,40px);line-height:1.1;font-weight:800;margin-bottom:10px}\n.m212x .hero h2 span{color:var(--green)}\n.m212x .hero p{color:var(--mute);font-size:17px;max-width:680px}\n.m212x .sec{background:var(--panel);border:1px solid var(--line);border-radius:14px;padding:24px;margin-bottom:22px;scroll-margin-top:110px}\n.m212x .sec h3{font-size:22px;font-weight:800;margin-bottom:8px}\n.m212x .sec h4{font-size:16px;font-weight:800;margin:16px 0 6px}\n.m212x .sec p{color:#cdd8e2;margin-bottom:10px}\n.m212x .lead{color:var(--mute) !important;margin-bottom:16px !important}\n.m212x .grid{display:grid;gap:14px;grid-template-columns:repeat(auto-fit,minmax(230px,1fr))}\n.m212x .card{display:block;background:var(--panel2);border:1px solid var(--line2);border-radius:10px;padding:18px;text-decoration:none;color:var(--ink)}\n.m212x a.card:hover{border-color:var(--green)}\n.m212x .card b{display:block;font-size:17px;margin-bottom:6px}\n.m212x .card p{color:var(--mute);font-size:14.5px;margin:0}\n.m212x .card .go{display:inline-block;margin-top:10px;font-size:13px;font-weight:800;letter-spacing:.06em;color:var(--green)}\n.m212x .ic{font-size:26px;display:block;margin-bottom:8px}\n.m212x ul.l,.m212x ol.l{padding-left:22px;color:#cdd8e2;margin-bottom:10px}\n.m212x ul.l li,.m212x ol.l li{margin-bottom:6px}\n.m212x table{width:100%;border-collapse:collapse;font-size:14.5px;margin:6px 0 12px}\n.m212x th{text-align:left;font-size:12px;letter-spacing:.12em;text-transform:uppercase;color:var(--mute);border-bottom:1px solid var(--line2);padding:8px}\n.m212x td{border-bottom:1px solid var(--line);padding:8px;vertical-align:top;color:#d3dde6}\n.m212x code,.m212x .mono{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:.9em}\n.m212x code{background:rgba(60,200,240,.1);color:#bfe9ff;padding:1px 5px;border-radius:4px}\n.m212x pre{font-family:\"JetBrains Mono\",\"DejaVu Sans Mono\",Consolas,monospace;font-size:13.5px;background:#060a0f;border:1px solid var(--line);border-left:3px solid var(--green);border-radius:6px;padding:12px 14px;overflow-x:auto;color:#cfe8d9;margin:6px 0 12px;white-space:pre}\n.m212x .callout{border:1px solid rgba(246,181,68,.4);background:rgba(246,181,68,.08);border-radius:10px;padding:14px 16px;margin:12px 0}\n.m212x .callout b{color:var(--amber)}\n.m212x .pill{display:inline-block;font-size:12px;font-weight:800;letter-spacing:.06em;padding:2px 9px;border-radius:999px;border:1px solid}\n.m212x .p-n{color:#9fb0c0;border-color:#3a4b5b}\n.m212x .p-l{color:var(--green);border-color:rgba(62,230,160,.5);background:rgba(62,230,160,.08)}\n.m212x .p-m{color:var(--amber);border-color:rgba(246,181,68,.5);background:rgba(246,181,68,.08)}\n.m212x .p-h{color:#ff8a5c;border-color:rgba(255,138,92,.5);background:rgba(255,138,92,.08)}\n.m212x .p-c{color:var(--red);border-color:rgba(255,84,104,.5);background:rgba(255,84,104,.08)}\n.m212x .toc{display:flex;flex-wrap:wrap;gap:8px;margin-top:18px}\n.m212x .toc a{font-size:14px;font-weight:700;text-decoration:none;color:var(--ink);background:var(--panel2);border:1px solid var(--line2);border-radius:999px;padding:7px 13px}\n.m212x .toc a:hover{border-color:var(--green);color:var(--green)}\n.m212x input[type=text],.m212x input[type=search],.m212x input[type=url]{width:100%;background:#060a0f;color:var(--ink);border:1px solid var(--line2);border-radius:8px;padding:12px 14px;font-size:16px;font-family:inherit}\n.m212x input:focus{outline:2px solid var(--cyan);outline-offset:1px}\n.m212x button{font-family:inherit;font-size:15px;font-weight:700;cursor:pointer;border-radius:8px;padding:11px 16px;border:1px solid var(--line2);background:var(--panel2);color:var(--ink)}\n.m212x button.pri{background:var(--green);color:#04130c;border-color:var(--green)}\n.m212x .help{display:flex;gap:18px;align-items:center;flex-wrap:wrap;background:linear-gradient(90deg,rgba(60,200,240,.12),rgba(62,230,160,.05));border:1px solid rgba(60,200,240,.35);border-radius:14px;padding:20px 24px}\n.m212x .help div{flex:1;min-width:240px}\n.m212x .help a.cta{display:inline-block;background:var(--cyan);color:#03141b;font-weight:800;text-decoration:none;border-radius:8px;padding:12px 18px}\n.m212x .small{font-size:13.5px;color:var(--mute)}\n<\/style><style>.m212x details{background:var(--panel2);border:1px solid var(--line);border-radius:10px;padding:10px 14px;margin:8px 0}.m212x details summary{cursor:pointer}.m212x details p{margin-top:8px;color:var(--mute)}.m212x .sec h4{margin:16px 0 6px}<\/style>\n<section class=\"hero\">\n<div class=\"kick\">MAG212 CYBER \u00b7 Learn \u00b7 Blue team \u00b7 Lab 4<\/div>\n<h2>Catch a brute-force attack <span>in the logs.<\/span><\/h2>\n<p>Every server on the internet gets login attacks. Most are loud and fail. The dangerous one is quiet: a few careful guesses that end in a real login. In this free lesson you read real-format Linux and Windows logs, find both kinds of attack, work out which account was broken into and what the attacker tried next, then write a detection rule so it is caught automatically.<\/p>\n<div class=\"toc\">\n<a href=\"#video\">Watch the video<\/a>\n<a href=\"#terms\">Brute force vs spraying<\/a>\n<a href=\"#setup\">Get the lab<\/a>\n<a href=\"#exercises\">The exercises<\/a>\n<a href=\"#rule\">The detection rule<\/a>\n<a href=\"#respond\">Respond and prevent<\/a>\n<a href=\"#quiz\">Check yourself<\/a>\n<\/div>\n<\/section>\n\n<section id=\"video\" class=\"sec\">\n<h3>Watch the walkthrough (5 minutes)<\/h3>\n<div style=\"position:relative;padding-top:56.25%;border-radius:12px;overflow:hidden;border:1px solid var(--line);margin:10px 0 12px\"><iframe src=\"https:\/\/www.youtube-nocookie.com\/embed\/gc-agOwwy14\" title=\"Catch a Brute-Force Attack in the Logs (Free Hands-On Lab)\" style=\"position:absolute;inset:0;width:100%;height:100%;border:0\" loading=\"lazy\" allow=\"accelerometer; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share\" referrerpolicy=\"strict-origin-when-cross-origin\" allowfullscreen><\/iframe><\/div>\n<p class=\"small\">Prefer YouTube? <a href=\"https:\/\/youtu.be\/gc-agOwwy14\" target=\"_blank\" rel=\"noopener\">Watch on YouTube<\/a> (English captions and chapters included).<\/p>\n<p class=\"small\">Level: beginner SOC analyst \u00b7 Time: about 45 minutes \u00b7 Needs: Python 3.9 or newer on Windows, macOS or Linux.<\/p>\n<\/section>\n\n<section id=\"terms\" class=\"sec\">\n<h3>Two attacks that look alike<\/h3>\n<table>\n<tr><th><\/th><th>Brute force<\/th><th>Password spraying<\/th><\/tr>\n<tr><td><b>What it does<\/b><\/td><td>Many passwords against a few accounts<\/td><td>One or two common passwords against many accounts<\/td><\/tr>\n<tr><td><b>Speed<\/b><\/td><td>Fast, often several tries a second<\/td><td>Slow, to stay under lockout limits<\/td><\/tr>\n<tr><td><b>MITRE ATT&amp;CK<\/b><\/td><td>T1110.001 Password guessing<\/td><td>T1110.003 Password spraying<\/td><\/tr>\n<tr><td><b>The clue in the logs<\/b><\/td><td>Many failures per account<\/td><td>Many accounts, about one failure each<\/td><\/tr>\n<\/table>\n<p>On Windows, the events to know are <b>4625<\/b> (failed logon), <b>4624<\/b> (successful logon) and <b>4740<\/b> (account locked out). In a 4625 event, SubStatus <code>0xC000006A<\/code> means the password was wrong (so the account exists) and <code>0xC0000064<\/code> means the user does not exist.<\/p>\n<\/section>\n\n<section id=\"setup\" class=\"sec\">\n<h3>Get the lab<\/h3>\n<p>The lab is a small folder: a Linux SSH log (<code>auth.log<\/code>), a Windows security log exported to CSV, a read-only Python analyzer, Sigma detection rules, seven exercises and an answer key. There is nothing to install.<\/p>\n<div class=\"callout\"><b>Download:<\/b> <a href=\"\/wp-content\/uploads\/2026\/11\/mag212-log-lab.zip\">mag212-log-lab.zip<\/a> (26 KB) \u00b7 unzip it, open a terminal in the folder, and run <code>python3 analyze_logs.py --help<\/code> (on Windows use <code>py<\/code> instead of <code>python3<\/code>).<\/div>\n<p class=\"small\"><b>Safety:<\/b> every log line is fictional and was generated for teaching, for a made-up company called Nimbus Coffee Co. The IP addresses come from ranges reserved for documentation (RFC 5737), so they belong to nobody. The tools only read files and make no network connections. Practise only on logs you own or are authorised to analyse.<\/p>\n<\/section>\n\n<section id=\"exercises\" class=\"sec\">\n<h3>The exercises<\/h3>\n<h4>1. Get the big picture<\/h4>\n<pre>python3 analyze_logs.py summary logs\/auth.log<\/pre>\n<p>Count the failed and successful logins, and notice any denied <code>sudo<\/code> commands. A denied sudo means someone who was already logged in tried to become root.<\/p>\n<h4>2. Who is attacking?<\/h4>\n<pre>python3 analyze_logs.py top-ips logs\/auth.log\ngrep \"Failed password\" logs\/auth.log | grep -oE \"from [0-9.]+\" | sort | uniq -c | sort -rn<\/pre>\n<p>Compare failures with the number of accounts tried for each address. One address is a brute force; another is a spray. The plain <code>grep<\/code> version works on any Linux server.<\/p>\n<h4>3. Which accounts were targeted?<\/h4>\n<pre>python3 analyze_logs.py users logs\/auth.log<\/pre>\n<p>Attackers try default names such as <code>root<\/code>, <code>admin<\/code> and <code>ubuntu<\/code> everywhere. Which ones really exist on this server?<\/p>\n<h4>4. Did anyone get in?<\/h4>\n<pre>grep \"Accepted password\" logs\/auth.log\npython3 analyze_logs.py timeline logs\/auth.log --ip 192.0.2.77<\/pre>\n<p>Separate the normal login (one typo from the office, then success) from the suspicious one, and build a timeline of what happened after it.<\/p>\n<h4>5. Windows: the attack that slips through<\/h4>\n<pre>python3 analyze_logs.py detect logs\/windows_security.csv\npython3 analyze_logs.py detect logs\/windows_security.csv --spray-users 5 --threshold 5<\/pre>\n<p>The default rules catch the loud attack that locks out Administrator. Find the quiet one that does not raise an alert, then lower the thresholds and think about the trade-off: more alerts, but also more false alarms.<\/p>\n<h4>6. Make it automatic<\/h4>\n<p>Open the Sigma rules in <code>detections\/<\/code> and read how they count events (see the next section).<\/p>\n<h4>7. Respond<\/h4>\n<p>Write down your first five actions for each compromised account. Then compare your work with <code>ANSWERS.md<\/code>.<\/p>\n<\/section>\n\n<section id=\"rule\" class=\"sec\">\n<h3>The detection rule<\/h3>\n<p>The lab&#8217;s rules use Sigma, an open format that many security tools can import or convert. A base rule matches Windows event 4625, and two correlation rules build on it:<\/p>\n<ul class=\"l\">\n<li><b>Brute force:<\/b> 10 or more failures from one IP address in 5 minutes (<code>event_count<\/code>).<\/li>\n<li><b>Spraying:<\/b> 5 or more different accounts from one IP address in 60 minutes (<code>value_count<\/code>).<\/li>\n<\/ul>\n<pre>title: Password Spraying - Many Accounts From One Source (Lab 4)\ncorrelation:\n    type: value_count\n    rules:\n        - mag212_win_failed_logon\n    group-by:\n        - IpAddress\n    timespan: 60m\n    condition:\n        field: TargetUserName\n        gte: 5\nlevel: high<\/pre>\n<p>With pySigma and its Splunk backend, the same rule converts into a Splunk search. The README shows the one-line command. The most valuable alert of all is <b>success after failures<\/b>: an address with several recent failures that then logs in.<\/p>\n<\/section>\n\n<section id=\"respond\" class=\"sec\">\n<h3>Respond and prevent<\/h3>\n<ol class=\"l\">\n<li>Disable the compromised accounts, reset their passwords and end active sessions.<\/li>\n<li>Block the attacking addresses at the firewall.<\/li>\n<li>Preserve the evidence: copy the logs and note the times.<\/li>\n<li>Check what the accounts touched: shell history, new files, scheduled tasks, new SSH keys, outbound connections.<\/li>\n<li>Look for the same addresses on other systems and tell your incident response lead.<\/li>\n<\/ol>\n<p><b>Prevention:<\/b> on Linux, use SSH keys and turn off password logins (<code>PasswordAuthentication no<\/code>, <code>PermitRootLogin no<\/code>). On Windows, never expose Remote Desktop directly to the internet, and remove unused accounts such as old interns. Everywhere: multi-factor authentication, banned-password lists, central logging and an alert on success after failures.<\/p>\n<\/section>\n\n<section id=\"quiz\" class=\"sec\">\n<h3>Check yourself<\/h3>\n<p>Try to answer from the lab output first, then open each answer.<\/p>\n<details><summary><b>1.<\/b> One address made 412 failed logins against 3 accounts. Brute force or spraying?<\/summary><p>Brute force: many failures per account, fast.<\/p><\/details>\n<details><summary><b>2.<\/b> Which address got into the Linux server, and as which user?<\/summary><p>192.0.2.77, as <code>jsmith<\/code>, at 13:54:18, after 17 failed attempts against other accounts.<\/p><\/details>\n<details><summary><b>3.<\/b> What did the attacker try right after logging in?<\/summary><p><code>sudo \/usr\/bin\/bash<\/code> and then reading <code>\/etc\/shadow<\/code> (the password hashes). Both were denied, because jsmith is not an administrator.<\/p><\/details>\n<details><summary><b>4.<\/b> Why did the default rules miss the Windows attack from 198.51.100.199?<\/summary><p>It made only 7 failures against 7 accounts, below the default thresholds (10 failures, 8 accounts), then logged in over Remote Desktop as <code>temp_intern<\/code>.<\/p><\/details>\n<details><summary><b>5.<\/b> What does SubStatus 0xC0000064 tell you in event 4625?<\/summary><p>The username does not exist. 0xC000006A means the account exists but the password was wrong.<\/p><\/details>\n<\/section>\n\n<section class=\"sec\">\n<h3>Sources and further reading<\/h3>\n<ul class=\"l\">\n<li><a href=\"https:\/\/attack.mitre.org\/techniques\/T1110\/\" target=\"_blank\" rel=\"noopener\">MITRE ATT&amp;CK T1110: Brute Force<\/a><\/li>\n<li><a href=\"https:\/\/sigmahq.io\/docs\/meta\/correlations.html\" target=\"_blank\" rel=\"noopener\">Sigma correlation rules<\/a><\/li>\n<li><a href=\"https:\/\/learn.microsoft.com\/en-us\/previous-versions\/windows\/it-pro\/windows-10\/security\/threat-protection\/auditing\/event-4625\" target=\"_blank\" rel=\"noopener\">Microsoft: Event 4625, an account failed to log on<\/a><\/li>\n<li><a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc5737\" target=\"_blank\" rel=\"noopener\">RFC 5737: IP address ranges reserved for documentation<\/a><\/li>\n<\/ul>\n<p class=\"small\">More labs: <a href=\"\/learn\/labs\/\">Hands-on Labs<\/a> \u00b7 Next steps: <a href=\"\/learn\/learning-paths\/\">SOC &amp; incident response path<\/a><\/p>\n<\/section>\n<div class=\"help\"><div><div class=\"kick\" style=\"margin-bottom:4px\">Need expert help?<\/div>\n<p style=\"font-size:17px;margin:0\"><b>MAG212 CYBER<\/b> offers network and cybersecurity consultation, penetration testing with MAG212 Atlas, and security seminars for organisations around the world.<\/p><\/div>\n<a class=\"cta\" href=\"\/services\/\">Explore our services \u2192<\/a><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Free hands-on blue-team lab: find brute force and password spraying in Linux and Windows logs, spot the compromised account, and write a Sigma detection rule.<\/p>","protected":false},"author":1,"featured_media":0,"parent":3385,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-3933","page","type-page","status-publish","hentry"],"_hostinger_reach_plugin_has_subscription_block":false,"_hostinger_reach_plugin_is_elementor":false,"_links":{"self":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3933","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/comments?post=3933"}],"version-history":[{"count":1,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3933\/revisions"}],"predecessor-version":[{"id":3936,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3933\/revisions\/3936"}],"up":[{"embeddable":true,"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/pages\/3385"}],"wp:attachment":[{"href":"https:\/\/cyber.mag212.com\/fr\/wp-json\/wp\/v2\/media?parent=3933"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}