Tell spraying and brute force apart in your own auth log

short · 40 min · Objective 2.4

Task

Generate both attack patterns against your own VM, then write the detection that distinguishes them — because the control that stops one does nothing about the other, and the log looks completely different.

Steps

  1. Create five local accounts with known passwords so there is something to fail against.
  2. Generate the brute force pattern: from a second shell, attempt SSH to ONE of those accounts with ten wrong passwords in quick succession.
  3. Generate the spraying pattern: attempt SSH to all five accounts with ONE common wrong password, one attempt each, spaced thirty seconds apart.
  4. Extract the failures: sudo grep 'Failed password' /var/log/auth.log > /tmp/failures.txt, capturing the username and source for each.
  5. Write /tmp/detect.py: it must report, per source address, the total failures, the number of DISTINCT usernames, and the maximum failures against any single username.
  6. Classify each pattern from those three numbers alone and write the rule into /tmp/detect.md — including why a per-account lockout threshold would catch one and miss the other entirely.

Verify

wc -l < /tmp/failures.txt
python3 /tmp/detect.py
python3 - <<'PY'
import re,collections
rows=[l for l in open('/tmp/failures.txt')]
users=collections.Counter()
for l in rows:
    m=re.search(r'for (?:invalid user )?(\S+) from', l)
    if m: users[m.group(1)]+=1
print('distinct usernames:',len(users),'| max per user:',max(users.values()))
assert len(users)>=5, 'the spray did not reach five accounts'
assert max(users.values())>=8, 'the brute force run was too short'
print('both patterns present and distinguishable')
PY

The assertions require both patterns to be genuinely present: at least five distinct usernames from the spray and at least eight failures against one account from the brute force. If only one assertion passes, only one pattern was generated and the detection has nothing to distinguish.

Notes

Now look at what a lockout policy of five attempts would have done to each. It ends the brute force at attempt five and never fires at all during the spray, because no account saw more than one failure. That is why spraying is detected in aggregate — per source, per time window, across all accounts — and it is the single most useful monitoring rule in this objective.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.