The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
SSH Brute-Force Attack Detection & Analysis (Wazuh SIEM)
This expands on a previously shared overview of this investigation. Here’s the full breakdown of how I approached it from a SOC perspective.
I recently simulated a controlled SSH brute-force attack on a Windows endpoint monitored through Wazuh SIEM to study how authentication attacks appear in real log data and how they can be detected through correlation.
The goal wasn’t just to “run a lab,” but to actually understand how SOC teams identify abnormal login behavior in noisy authentication logs.
🧪 What the scenario looked like
I set up a simple attack flow that included:
- Basic network discovery to identify the SSH service
- A low-volume dictionary brute-force attempt using a small password set (9 tries via Hydra)
- Authentication attempts against Windows OpenSSH
This was intentionally kept low-noise to mimic a more realistic targeted attack rather than a noisy brute-force flood.
🔍 What stood out in the logs
While analyzing Windows Security Event Logs through Wazuh, I focused on authentication patterns and immediately saw:
- Repeated Event ID 4625 (failed logins)
- Followed by a single Event ID 4624 (successful login)
- Logon Types showing network-based access patterns (Type 8 → Type 3 transition)
What made it interesting wasn’t just the events themselves — it was the pattern between them.
A clean failure → success transition is often one of the strongest brute-force indicators in real SOC environments.
⚠️ Key observation
Even though this was a small 9-attempt simulation, it still produced a clear detection signal.
The pattern showed:
- Consistent failed authentication attempts
- No prior successful baseline activity for that user context
- A sudden successful login immediately after repeated failures
That combination is exactly what SOC analysts look for in brute-force detection scenarios.
🧠 What I learned from this
This exercise helped reinforce how authentication attacks can be detected even when they’re low-volume and not noisy.
More importantly, it showed how much value comes from simple correlation:
failed logins → timing → eventual success.
That’s often enough to flag a real brute-force attempt in a SOC pipeline.
🛡️ MITRE ATT&CK mapping
T1110 – Brute Force
T1078 – Valid Accounts
T1046 – Network Service Discovery
📌 Full breakdown
I’ve documented the full technical workflow, logs, and setup here:
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Related posts
I have a security system designed to combat bots. It collects comprehensive user fingerprint data—ranging from cookies to behavioral patterns—which I use to monitor visitor activity and block bots attempting to compromise my site. The code can also revoke a visitor's trust score and terminate their session.
AI Fraud Detection: Real-Time Risk Engine
A digital payments startup processing over 100,000 daily transactions needed a high-throughput, low-latency AI fraud detection engine to intercept fraudulent charges, account takeovers (ATO), and identity theft in real time without creating friction for legitimate customers.
Key Challenges:
Reducing high false-positive rates that caused cart abandonment and user churn.
Evaluating complex behavioral features and payment metadata in under 60 milliseconds.
Adapting to rapidly shifting fraud tactics without requiring full model retraining.
Technical Implementation & Solution:
• Real-Time Feature Pipeline: Engineered an ultra-fast streaming pipeline using Apache Kafka, Redis, and FastAPI to compute transaction velocity and device fingerprints on the fly.
• Hybrid Machine Learning Architecture: Deployed an ensemble model combining XGBoost, Isolation Forests, and Graph Neural Networks (GNN) to uncover hidden mule-account rings.
• Explainable AI (XAI): Integrated SHAP values into the decision engine, providing compliance analysts with immediate human-readable reasons for flagged transactions.
• Automated Webhook Routing: Created dynamic webhooks to instantly trigger Step-Up 2FA, soft declines, or outright blocks based on real-time risk scores.
Results & Impact:
• Slashed fraudulent chargeback losses by 43% in the first quarter.
• Reduced false-positive transaction declines by 28%.
• Achieved sub-45ms average inference latency across peak payment volumes.
Premium E-commerce Platform for Fashion Retail
I built this online fashion store for a client who needed a professional way to sell clothing. It is designed to look modern and can easily handle a large number of products and secure payments without slowing down.
Used Java and MySQL with Hibernate to ensure the site is fast and stable. This makes it easy for customers to browse through categories, filter items, and check out smoothly.
The layout is fully responsive, meaning it works perfectly on smartphones. High-quality images load quickly, so the shopping experience feels premium and remains fast on any screen size.
I also added an admin dashboard so the owner can track orders and manage stock in real-time. It is a complete, professional solution for anyone looking to launch or grow a clothing brand.
