1

I'm currently working on a software project as part of a course on Operating Systems Security and one of the features in my project is to detect bruteforce attacks on Windows hosts.

I know that I can easily accomplish this by checking for event ID 4625 and other events in Windows Event Log, but I want that my software works even if Windows Event Log is disabled.

Is there a possibility to do that without using Windows Event Log? Maybe something using Windows API?

This project is in C#, but I don't have problems with C if needed to write some low-level code.

Improve this question
1
  • What type of brute-forcing are you aiming to detect? SSH password cracking, open port scanning, vuln scanning?
    – belkarx
    Commented Jan 1, 2022 at 1:24

1 Answer 1

Reset to default
2

Brute force attempts usually show up as lots of similar network traffic within a "short" period of time. So, if you can monitor the network from you code, you can see it.

  • The easiest one would be to detect someone bruteforcing from a single IP: just keeping track of how many packets a coming from said IP would get you going. But then you need to account for, say, how much traffic Netflix or pornhub sends.
  • Next would be to look at the payload of the given packet, which works better with unencrypted traffic. Look for login attempts, for instance

If bruteforce attack was successful,

  • You can get a list of the processes which are either listening to or sending traffic and eliminate the legit ones.
  • Another thing is to look at outgoing traffic, which may indicate something is talking back to the mothership. Case in point is bitcoin mining.
Improve this answer
1
  • Outgoing traffic is more indicative of effective infection of the target PC (as opposed to bruteforcing which is what's in scope for detection)
    – belkarx
    Commented Jan 1, 2022 at 1:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .