Brute-force Attack Detection with Wazuh Security Monitoring

Wazuh is an open-source security monitoring platform designed to help organizations detect and respond to security threats in real time. It provides capabilities for log analysis, intrusion detection, vulnerability detection, and compliance monitoring. By integrating with tools like Elastic Stack, Wazuh offers powerful data visualization and alerting features, making it easier for security teams to identify potential risks and enhance their overall security posture. Its flexibility and scalability make it suitable for environments of all sizes, from small businesses to large enterprises.

Lab :

wazuh-server : 192.168.229.10 kali linux : 192.168.229.101 debian (wazuh-agent) : 192.168.229.2

SSH CONFIGURATION ON THE VICTIM :

sudo apt update && sudo apt install openssh-server -y

sudo systemctl start ssh sudo systemctl enable ssh

sudo nano /etc/ssh/sshd_config

PasswordAuthentication yes

SSH BRUTEFORCE FROM KALI :

we gonna use hydra to bruteforce ssh .Hydra is a popular open-source password-cracking tool used for conducting brute-force attacks on various network protocols and services. It supports a wide range of protocols, including SSH, FTP, HTTP, and more, making it versatile for penetration testing and security assessments. Hydra allows users to perform fast and efficient attacks by leveraging wordlists, enabling the testing of multiple login credentials simultaneously. Its user-friendly command-line interface and extensive documentation make it a go-to tool for security professionals looking to identify weak passwords and strengthen system defenses.

syntax:

hydra -l <Username> -P <password_list.txt> ssh://<Ubuntu_Server_IP_Address>

After launching the attack, we found the password: p@ssw0rd

Visualize alerts from wazuh :

From the Wazuh interface we can visualize the alerts of the brute force attack.

As we can see, we got 333 authentication failures, which indicates a brute-force attack on our victim machine.

we can have a lot of information about the attack

The key information we obtained from these alerts includes:

• The attacker’s IP address
• The attacker’s source port
• The victim’s hostname and IP address
• The attack technique classified in the MITRE ATT&CK framework

Vulnerabilities detection in Wazuh :

wazuh can alse detect the vulnerabilities in the system and give us the CVE-NUMBER

Overall Vulnerabilities in the victim machine: 1 Critical 85 Medium 10 Low 195 Pending Evaluation

Top Vulnerabilities: The dashboard lists the top vulnerabilities affecting the system, including the severity levels and the number of occurrences for each. Top Operating System: It specifies that the vulnerabilities are primarily related to the Debian GNU/Linux 10 (Buster) version. Top Packages: This section highlights the most affected packages, indicating the need for attention and potential remediation.

Conclusion :

Wazuh is a powerful security platform that goes beyond brute-force attack detection. It can be used for malware detection, intrusion detection, log analysis, vulnerability management, cloud security monitoring, and compliance auditing. By integrating Wazuh, organizations can enhance threat detection and response across various cybersecurity scenarios.