SOC › Module 7 › Lesson 3
Detect Brute Force
Brute force detection literacy — failed auth spike, spray pattern, lockout events — triage named class on $SOC_LAB sample alerts.
Visual · t29_detect_brute_force
Detect brute force = named detection class literacy. $SOC_LAB. Original Cyberlium.
Opening
Auth failure spikes have shapes — learn brute-force and password-spray detection vocabulary on YOUR sample logs, never how to run those attacks.
Brute force detection literacy names: failed login spike (4625/audit category), password spray pattern (many users, one password category), single-user lockout row, geo-impossible auth category, and VPN/auth gateway threshold alert. Analyst triages $SOC_LAB sample Windows/Linux auth log alert — counts failures in lab timeframe, checks enrichment user/asset rows — without running password spray against real accounts, without credential stuffing on stranger services, without disabling lockout policy on prod. Cyberlium teaches defender detection vocabulary on instructor synthetic auth exports. Refused: unauthorized password attacks, bypassing MFA on stranger apps, prod account lockout tests without RoE. Lab row: four brute-force pattern types with FP/TP disposition example each.
1. Named brute-force patterns
Vertical brute force, password spray, lockout storm, geo-anomaly — four literacy anchors.
Detection class literacy — not running credential attacks.
Command guide
Try these commands — Named brute-force patterns
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MITRE T1110 — https://attack.mitre.org/techniques/T1110/ (brute force detection) MITRE T1110.001 — https://attack.mitre.org/techniques/T1110/001/ Sigma brute force — https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install jq sudo apt install curl
macOS:
Command — copy this
brew install jq
Windows:
Command — copy this
choco install jq
Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export SOC_LAB=${SOC_LAB:-$HOME/cyberlium-lab/t29-soc}
curl -sS https://attack.mitre.org/techniques/T1110/001/ | head -10
jq -c 'select(.mitre|startswith("T1110"))' "$SOC_LAB/logs/alerts.json"
cat > "$SOC_LAB/notes/brute-detection-literacy.txt" <<'EOF'
Brute-force DETECTION (not offense):
- multiple 4625 from same src_ip (YOUR auth.jsonl)
- administrator + external IP (203.0.113.50)
- alert count field in alerts.json (ALR-001, ALR-002)
HARD BAN: hydra, medusa, ncrack — detect pattern in YOUR logs only
EOFCommand — copy this
grep 'HARD BAN' "$SOC_LAB/notes/brute-detection-literacy.txt"
Primary tools to practice this lesson: jq, curl. Reference sites: MITRE T1110 (https://attack.mitre.org/techniques/T1110/); MITRE T1110.001 (https://attack.mitre.org/techniques/T1110/001/); Sigma brute force (https://github.com/SigmaHQ/sigma/tree/master/rules/windows/builtin/security). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Triage actions
Verify service account vs human user, check patch/maintenance window, enrich source IP stub, ticket if TP.
Failed auth alone may be FP-Tuning if threshold too low — link Module 6-2.
3. Refused
No unauthorized password spray or brute force; no lockout policy disable on prod.
Brute-force detection literacy supports triage — not attack execution.
4. What you ship: brute-force detection literacy card
Four pattern types + FP/TP example each + NEVER run brute-force line.
5. What you record before the next lesson
Brute-force detection literacy card path.
6. Wrong vs right: stranger SIEM vs YOUR sample logs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run password spray against employer VPN as 'detection validation.'
Right
Brute-force detection card from $SOC_LAB auth sample. Next: Detections Lab.
Mission: brute-force detection literacy card
1) Name four brute-force pattern types. 2) One FP/TP example per pattern. 3) Apply to one sample auth alert. 4) Write NEVER run brute-force line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Spray vs vertical brute — log shape difference?”
Knowledge Check
APPLY: Brute-force detection literacy means:
Multiple choice
Knowledge Check
APPLY: True or False: Running password spray without authorization is lab.
True or False
Knowledge Check
APPLY: Password spray pattern shows:
Multiple choice