SOC › Module 7 › Lesson 3
Detect Brute Force
Brute force detection literacy — failed auth spike, spray pattern, lockout events — triage named class on $SOC_LAB sample alerts.
Visual · t29_detect_brute_force
Detect brute force = named detection class literacy. $SOC_LAB. Original Cyberlium.
Opening
Auth failure spikes have shapes — learn brute-force and password-spray detection vocabulary on YOUR sample logs, never how to run those attacks.
Brute force detection literacy names: failed login spike (4625/audit category), password spray pattern (many users, one password category), single-user lockout row, geo-impossible auth category, and VPN/auth gateway threshold alert. Analyst triages $SOC_LAB sample Windows/Linux auth log alert — counts failures in lab timeframe, checks enrichment user/asset rows — without running password spray against real accounts, without credential stuffing on stranger services, without disabling lockout policy on prod. Cyberlium teaches defender detection vocabulary on instructor synthetic auth exports. Refused: unauthorized password attacks, bypassing MFA on stranger apps, prod account lockout tests without RoE. Lab row: four brute-force pattern types with FP/TP disposition example each.
1. Named brute-force patterns
Vertical brute force, password spray, lockout storm, geo-anomaly — four literacy anchors.
Detection class literacy — not running credential attacks.
Command guide
Try these commands — Named brute-force patterns
═══ LINUX / BASH (SOC Analyst Triage) ═══
Filter system logs for security-relevant warnings and errors
Command — copy this
journalctl -p 3 -xb --no-pager | head -20
Search for suspicious persistent cron entries or service changes
Command — copy this
ls -lat /etc/cron.* /etc/systemd/system/ | head -15
═══ WINDOWS POWERSHELL ═══ Triage recent system service installations (Event 7045)
Command — copy this
Get-WinEvent -FilterHashtable @{LogName='System';Id=7045} -MaxEvents 5 -ErrorAction SilentlyContinue | Format-Table TimeCreated, Message -WrapCheck open listening network connections with process owners
Command — copy this
Get-NetTCPConnection -State Listen | Select-Object LocalAddress, LocalPort, OwningProcess | Sort-Object LocalPort
Primary tools to practice this lesson: jq, curl. Reference sites: MITRE T1110 (https://attack.mitre.org/techniques/T1110/); MITRE T1110.001 (https://attack.mitre.org/techniques/T1110/001/); Sigma brute force (https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Triage actions
Verify service account vs human user, check patch/maintenance window, enrich source IP stub, ticket if TP.
Failed auth alone may be FP-Tuning if threshold too low — link Module 6-2.
3. Refused
No unauthorized password spray or brute force; no lockout policy disable on prod.
Brute-force detection literacy supports triage — not attack execution.
4. What you ship: brute-force detection literacy card
Four pattern types + FP/TP example each + NEVER run brute-force line.
5. What you record before the next lesson
Brute-force detection literacy card path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run password spray against employer VPN as 'detection validation.'
Right
Brute-force detection card from $SOC_LAB auth sample. Next: Detections Lab.
Mission: brute-force detection literacy card
1) Name four brute-force pattern types. 2) One FP/TP example per pattern. 3) Apply to one sample auth alert. 4) Write NEVER run brute-force line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Spray vs vertical brute — log shape difference?”
Knowledge Check
APPLY: Brute-force detection literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: Running password spray without authorization is lab.
True or False
Knowledge Check
APPLY: Password spray pattern shows:
Multiple choice