1

I'm currently working on a software project as part of a course on Operating Systems Security and one of the features in my project is to detect bruteforce attacks on Windows hosts.

I know that I can easily accomplish this by checking for event ID 4625 and other events in Windows Event Log, but I want that my software works even if Windows Event Log is disabled.

Is there a possibility to do that without using Windows Event Log? Maybe something using Windows API?

This project is in C#, but I don't have problems with C if needed to write some low-level code.

1
  • What type of brute-forcing are you aiming to detect? SSH password cracking, open port scanning, vuln scanning?
    – belkarx
    Jan 1 at 1:24

1 Answer 1

2

Brute force attempts usually show up as lots of similar network traffic within a "short" period of time. So, if you can monitor the network from you code, you can see it.

  • The easiest one would be to detect someone bruteforcing from a single IP: just keeping track of how many packets a coming from said IP would get you going. But then you need to account for, say, how much traffic Netflix or pornhub sends.
  • Next would be to look at the payload of the given packet, which works better with unencrypted traffic. Look for login attempts, for instance

If bruteforce attack was successful,

  • You can get a list of the processes which are either listening to or sending traffic and eliminate the legit ones.
  • Another thing is to look at outgoing traffic, which may indicate something is talking back to the mothership. Case in point is bitcoin mining.
1
  • Outgoing traffic is more indicative of effective infection of the target PC (as opposed to bruteforcing which is what's in scope for detection)
    – belkarx
    Jan 1 at 1:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.