Threat Hunting
Difficulty: medium
Log Format: syslog
Password Spray
Twelve users. One password attempt each. Spread across 47 minutes from the same IP. Fail2ban never triggered. One account caved. This is what a spray looks like — and why it's so hard to catch.
Password SprayAccount CompromiseLow and Slow
Investigation Scenario
Twelve users. One password attempt each. Spread across 47 minutes from the same IP. Fail2ban never triggered. One account caved. This is what a spray looks like — and why it's so hard to catch.