I am currently reading through Windows Event Log (OpenSSH) looking at the artefacts created by an attack, I am trying to understand the meaning of certain notifications.
A brute force attack was made by myself, from a Kali Linux machine and the software I use was Metasploit.
In Kali Linux when I ran the nmap command on the target machine, I looked instantly at Windows Event Viewer and received this SSH notification:
- “sshd: Did not receive identification string from ipaddress on port portnumber”
I was hoping to receive information about the attacker machine (Linux) such as name of machine or user or is this not possible?