What you need
Read access to the logs, a copy you can take off the machine, and a note of the system's time zone. Log Forensics parses Windows .evtx, syslog, auth.log and secure files, Apache and nginx access and error logs and IIS W3C logs, entirely in your browser.
Reading the result
Here is part of an Ubuntu auth.log (trimmed; the file has 17 lines):
Oct 8 02:14:03 web01 sshd[4101]: Accepted publickey for alice from 192.0.2.10 port 50122 ssh2: ED25519 SHA256:k3Yp0wq9
Oct 8 03:12:00 web01 sshd[4200]: Failed password for root from 203.0.113.45 port 40000 ssh2
Oct 8 03:12:07 web01 sshd[4201]: Failed password for root from 203.0.113.45 port 40001 ssh2
... (8 failures for root, 7 seconds apart)
Oct 8 03:40:00 web01 sshd[4300]: Failed password for invalid user admin from 198.51.100.23 port 51000 ssh2
Oct 8 03:40:09 web01 sshd[4301]: Failed password for invalid user test from 198.51.100.23 port 51001 ssh2
... (6 different user names, one attempt each)
Loaded into the tool, it produces these findings:
- High: "5 failed authentication attempts against a single account/source were seen in a short window - the shape of a brute-force attack." Source: 203.0.113.45.
- High: "5 failed logins across 5 different accounts came from a single source in a short window - a password-spraying pattern, not a targeted brute force." Source: 198.51.100.23.
- Info: the 17 syslog lines carry no year, so the year was inferred.
The numbers are the point at which each detector fired, not the totals: filtering on 203.0.113.45 shows all 8 attempts, and on 198.51.100.23 all 6 user names. Brute force is reported for at least 5 failures from one source within 5 minutes against fewer than 5 accounts; spraying for at least 5 accounts with no more than 2 attempts each within 10 minutes. A success from the same source within 2 minutes of a brute-force burst produces a third finding, the one to act on first.
Alice's key-based login from 192.0.2.10 raises nothing, as it should.
On Windows, the reason for a failed logon (event 4625) is in its status code:
| Status | Shown as | Suggests |
|---|---|---|
0xC000006A |
Bad password | The account exists; someone is guessing its password |
0xC0000064 |
No such user account | User names are being guessed |
0xC0000234 |
Account locked out | Lockout has triggered |
0xC0000072 |
Account disabled | Attempts on a disabled account |
Common pitfalls
- Pasting a few lines instead of the file. Format detection samples the file; a short excerpt of sshd lines alone may be read as plain syslog without the login analysis. Load the complete log.
- Blaming the IP owner. Attack traffic usually comes from hijacked machines, cloud servers or VPNs. The lookup tells you the network, not the person.
- Ignoring shared addresses. Many users behind one office or mobile carrier address can look like a single source.
- Mixing time zones. Syslog records local time without a zone, while
.evtxrecords UTC. Know each system's zone before reading a merged timeline. - Missing the quiet signals. A cleared Security log (event 1102) or a gap in an otherwise busy log can matter more than a thousand failures.
Going further
Repeated failures from many addresses against one account are a sign it is being targeted: protect it with Multi-factor authentication (MFA) even if no attempt has succeeded. Unusual successful logins, new accounts (event 4720) and new services (event 7045) are each worth a look in the same timeline.