1. What is a Brute Force attack?
A brute force attack consists of automatically testing thousands (or
even millions) of username/password combinations until the correct one
is found.
Objective:
- Gain access to an account (email, VPN, server…)
- Take control of a system
- Move laterally within the network (larger attack)
2. How does it work?
Real-world operation (as seen in a SOC):
1. The attacker selects a target (e.g., admin account)
2. Uses an automated tool (e.g., Hydra, Burp Suite, scripts)
3. Sends mass login requests:
- login + password1
- login + password2
- login + password3
4. Exploits:
- weak passwords
- lack of login attempt limitations
Variants:
- Password spraying (one password across multiple accounts)
- Credential stuffing (using leaked credentials)
3. How to detect it?
SOC Indicators (very important)
- High number of failed logins (FAILED LOGIN)
- Multiple attempts within seconds
- One IP targeting multiple accounts
- Abnormal activity outside working hours
Detection via SOC tools
1. SIEM (e.g., Splunk / Wazuh)
Tab used:
- Search / Discover / Logs
What you see on screen:
```
Event: Failed login
User: admin
Source IP: 192.168.1.50
Count: 150 attempts in 2 minutes
```
Typical query:
```
failed password OR login failed
```
Alerts:
- "Multiple failed login attempts"
- "Brute force suspected"
2. EDR (e.g., Microsoft Defender for
Endpoint)
Tab:
- Incidents / Alerts
Display:
- Alert: "Suspicious authentication activity"
- Timeline showing multiple attempts
3. Active Directory (Windows Logs)
Tab:
- Event Viewer → Security
Important Event ID:
- 4625 → failed login
Example:
```
Account failed to log on
Failure Reason: Unknown user or bad password
```
4. Firewall / VPN (e.g., FortiGate)
Tab:
- Logs & Report → Authentication
What you see:
- Multiple attempts from the same IP
- Suspicious country
4. What to do? (SOC Response)
Level 1 (Junior Analyst)
- Verify:
- Number of attempts
- Source IP
- Targeted account
- Confirm brute force suspicion
Immediate actions
- Block the IP (Firewall)
- Disable or lock the account
- Enable automatic lockout if not configured
Level 2 (Investigation)
- Check if any login succeeded after failures
- Look for suspicious activity post-login
- Analyze other targeted accounts
Containment
- Isolate the machine if compromised
- Reset passwords
- Enforce MFA
5. Prevention
Essential measures
- MFA (Multi-Factor Authentication) ✅
- Strong password policy
- Login attempt limitation (account lockout)
- CAPTCHA (web)
SOC best practices
- SIEM alerts properly configured
- 24/7 monitoring
- Automatic IP blocking (SOAR)
Recommended tools
- SIEM: Splunk / Wazuh
- EDR: Microsoft Defender for Endpoint
- Firewall: FortiGate
6. What the student must remember
A brute force attack = many login attempts in a short time
Detection = logs + SIEM + Event ID 4625
Response =
- Block
- Investigate
- Secure
Prevention =
MFA + strong passwords + attempt limitation
Copyright © All rights reserved.