Unit 8: Logs and the timeline · Lesson 3 of 8 · 16 min
Tracing an attack
Rank the sources of the failures, then prove whether any of them got in.
mission
- You are
- You are answering the question every manager asks: did they get in?
- Situation
- Two addresses guessed passwords on 14 October.
- Goal
- Rank the guessers and check every successful login.
- Hand in
- The main attacker and the source of every successful login.
Pull addresses out with a pattern
Failed password for root from 203.0.113.77 port 47936 ssh2 Invalid user admin from 198.51.100.23 port 44604
2 matches. Group 1: 203.0.113.77, 198.51.100.23
Rank the sources
grep 'Failed password' auth.log | grep -oE 'from [0-9.]+' | sort | uniq -c | sort -rn
150 from 198.51.100.23
46 from 203.0.113.77
1 from 192.0.2.10
you should see Two guessers, and one mistyped password from the office address.
Check every success
grep Accepted auth.log
Oct 14 08:52:30 root-lab sshd[4797]: Accepted password for omar from 192.0.2.10 port 62770 ssh2
Oct 14 10:30:45 root-lab sshd[4868]: Accepted publickey for dana from 192.0.2.10 port 63083 ssh2
Oct 14 13:05:02 root-lab sshd[4932]: Accepted publickey for omar from 192.0.2.10 port 50175 ssh2
Oct 14 17:44:09 root-lab sshd[5951]: Accepted publickey for omar from 192.0.2.10 port 63208 ssh2
you should see All four from the office. Neither attacker got in over SSH that day.
Bound the second attack
grep '203.0.113.77' auth.log | head -n 1 Oct 14 16:05:36 root-lab sshd[5027]: Failed password for root from 203.0.113.77 port 47936 ssh2 grep '203.0.113.77' auth.log | tail -n 1 Oct 14 16:10:42 root-lab sshd[5893]: Connection closed by invalid user admin 203.0.113.77 port 44449 [preauth]
defender tip First and last seen times go straight into the incident ticket.
What a defender takes away
- 1Rank sources with grep -o and the counting pipeline.
- 2Then check every Accepted line.
- 3Record first and last seen for each source.
Questions
0 of 3 solved
Answer each one from what you find on your lab machine.