SSH Brute-Force Detection in Splunk

Overview

The aim of this project is to simulate a brute-force attack against an SSH service using Metasploit and detect it using Splunk as a SIEM platform. It also includes building a Splunk dashboard to visualize failed login attempts and creating an alert to automatically respond to potential attacks.

Systems

The lab environment consists of two machines:

• Kali Linux (kali) - adversary machine
• Fedora Linux (fedora) - target + monitoring system

Tools

Tools used:

• Metasploit Framework - brute-force attack
• Nmap - service discovery and enumeration
• Splunk - log ingestion, analysis, detection, visualization
• /var/log/secure - authentication logs (Fedora equivalent of /var/log/auth.log on Debian)

Project Structure

The repository is divided into separate files, each showcasing different parts of the project:

• queries/: SPL queries used for detection and analysis
• screenshots/: Dashboard views, alert configuration, and results
• sample_logs/: Example log entries showing SSH attempts

Project Workflow:

1. Environment Setup

• Configure SSH on Fedora
• Install and configure Splunk
• Create a dedicated index 'security'
• Add /var/log/secure as a monitored data source

2. Reconnaissance

• Use Nmap from Kali to discover open ports
• Identify SSH service running on port 22

3. Attack Simulation

• Perform a brute-force attack using Metasploit

4. Detection Logic

• Create SPL queries to detect brute-force patterns:
  • multiple failed login attempts within a defined time window
  • repeated attempts from a single IP address
• Additionally, the project includes detection of successful logins following multiple failed attempts:
  • correlation of failed and successful authentication events using transaction logic
  • identification of login success after a series of failed attempts from the same IP and user

This pattern may indicate a successful brute-force attack or potential account compromise.

5. Visualization and Alerting

• Build a Splunk dashboard to monitor activity
• Create an alert triggered by excessive failed login attempts

Sample Logs

For security reasons logs were stripped from true IP and user with sed commands:

• sed -E "s/[0-9]+.[0-9]+.[0-9]+.[0-9]+/XXX.XXX.XXX.XXX/" sample_logs.txt
• sed -E "s/[0-9a-zA-Z]+ from/USER from/" sample_logs.txt

Contact

If you have any questions or feedback, feel free to reach out via GitHub.