Spray, stuff and travel impossibly

short · 50 min · Objective 1.2

Task

Produce three distinct identity attack patterns against your own lab accounts and write the query that separates each from ordinary failure. They look alike in a count of failed logins and are completely different in shape.

Steps

  1. Create ten accounts on the Linux VM: user01 through user10.
  2. Brute force: attempt twenty wrong passwords against user01 only, in one minute.
  3. Password spray: attempt exactly one wrong password against each of the ten accounts, spread over ten minutes.
  4. Credential stuffing shape: attempt one login against five accounts, each with a different wrong password, from the Windows VM rather than the console.
  5. Finally, authenticate user03 successfully from the Linux console and, within one minute, from the Windows VM -- your impossible travel.
  6. Write one query for each pattern. Then check each query against the other two patterns and note the false positives.

Verify

grep "Failed password" /var/log/auth.log | awk '{print $(NF-5)}' | sort | uniq -c | sort -rn | head -3
grep "Failed password" /var/log/auth.log | awk '{print $(NF-5)}' | sort -u | wc -l
grep "Accepted" /var/log/auth.log | grep user03 | awk '{print $(NF-3)}' | sort -u | wc -l

The first must show one account with around twenty failures -- brute force, visible as a tall spike on one account. The second must be at least ten: spraying is wide and shallow, so the distinct account count is the signal, not the failure count. The third must be 2 -- one account, two source addresses, which is the impossible-travel shape in its simplest form.

Notes

Note what the totals do. Brute force and spraying can produce the same number of failed logins; only the distribution across accounts separates them, which is why a threshold on failure count alone catches one and misses the other.

Your impossible travel query will fire on anyone with a laptop and a phone. Write down what additional field would reduce that -- and whether your logs carry it.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.