Comprehensive Analysis of SSH Brute-Force Detection with WazuhComprehensive Analysis of SSH Brute-Force Detection with Wazuh
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
Aaliya's avatar
Aaliya Khalil
• Jun 1
SSH Brute-Force Attack Detection & Analysis (Wazuh SIEM)
This expands on a previously shared overview of this investigation. Here’s the full breakdown of how I approached it from a SOC perspective.
I recently simulated a controlled SSH brute-force attack on a Windows endpoint monitored through Wazuh SIEM to study how authentication attacks appear in real log data and how they can be detected through correlation.
The goal wasn’t just to “run a lab,” but to actually understand how SOC teams identify abnormal login behavior in noisy authentication logs.
🧪 What the scenario looked like
I set up a simple attack flow that included:
- Basic network discovery to identify the SSH service
- A low-volume dictionary brute-force attempt using a small password set (9 tries via Hydra)
- Authentication attempts against Windows OpenSSH
This was intentionally kept low-noise to mimic a more realistic targeted attack rather than a noisy brute-force flood.
🔍 What stood out in the logs
While analyzing Windows Security Event Logs through Wazuh, I focused on authentication patterns and immediately saw:
- Repeated Event ID 4625 (failed logins)
- Followed by a single Event ID 4624 (successful login)
- Logon Types showing network-based access patterns (Type 8 → Type 3 transition)
What made it interesting wasn’t just the events themselves — it was the pattern between them.
A clean failure → success transition is often one of the strongest brute-force indicators in real SOC environments.
⚠️ Key observation
Even though this was a small 9-attempt simulation, it still produced a clear detection signal.
The pattern showed:
- Consistent failed authentication attempts
- No prior successful baseline activity for that user context
- A sudden successful login immediately after repeated failures
That combination is exactly what SOC analysts look for in brute-force detection scenarios.
🧠 What I learned from this
This exercise helped reinforce how authentication attacks can be detected even when they’re low-volume and not noisy.
More importantly, it showed how much value comes from simple correlation: failed logins → timing → eventual success.
That’s often enough to flag a real brute-force attempt in a SOC pipeline.
🛡️ MITRE ATT&CK mapping
T1110 – Brute Force
T1078 – Valid Accounts
T1046 – Network Service Discovery
📌 Full breakdown
I’ve documented the full technical workflow, logs, and setup here:
https://contra.com/p/sZXZl7Xm-brute-force-attack-detection-using-wazuh-siem?r=alkhal_vio107rc
Back to feed
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started