02. 03. 2020 Franco Federico Log-SIEM, NetEye

Preventing a Brute Force Attack with NetEye SIEM

I have several clients who’ve asked me how they can prevent a brute force attack inside their Windows Infrastructure. This is the use case for this blog post, a solution for which I’ve been studying using NetEye together with its SIEM module.

I’ve used a Windows client here, but it’s the same for any server in which I’ve installed Winlogbeat and configured it to send all security events to the Logstash component inside NetEye.

I’ve written previously about Winlogbeat and how to configure it here.

I’ve used Winlogbeat 7.4.2 for this configuration, under NetEye 4.10 with the SIEM module which includes Elastic Stack 7.4 Platinum Edition.

If I’ve set up multiple servers in order to reduce the number of installations of Winlogbeat clients per server, I can create a Windows Server collector and use WEF (Windows Events Forward), then configure all servers on my infrastructure to send security events to the collector.

When Logstash receives data, it loads Elasticsearch, where I can create a dashboard to show log-ons, log-offs, and failed log-ons using ECS-specified field names. To see the results, let’s open NetEye:

Then open Log Analytics and navigate to Elastic Stack:

Now we have a dashboard that shows failed log-on attempts:

So can NetEye help us prevent brute force attacks? It’s simple with Tornado. I’ll make use of two old blog posts from my colleague Angelo here and here.

To test this solution I‘ll try one of the common user names used in this type of attack (let’s pick TEST):

  • ADMINISTRATOR
  • ADMINISTRADOR
  • ADMIN
  • TEST
  • LAPTOP
  • SHOP
  • JOE
  • JULIE
  • SUPORTE
  • SERVIDOR
  • DANIELTS

When we exceed the threshold of 10 attempts, we’ll find an alert on NetEye that could be used to send notifications to the NetEye Admin account via e-mail, SMS, Slack, telegram, etc. So now we just need to attach the alarms, one on the user account:

and one on the server account:

Franco Federico

Franco Federico

Hi, I’m Franco and I was born in Monza. Over the last 20 years I worked for IBM in various roles. I started as a customer service representative (help desk operator), then I was promoted to Windows expert. In 2004 I changed again and was promoted to consultant, business analyst, then Java developer, and finally technical support and system integrator for Enterprise Content Management (FileNet). Several years ago I became fascinated by the Open Source world, the GNU\Linux operating system, and security in general. And so in the last 4 years during my free time I studied security systems and computer networks in order to extend my knowledge. I came across several open source technologies including the Elastic stack (formerly ELK), and started to explore them and other similar ones like Grafana, Greylog, Snort, Grok, etc. I like to script in Python, too. In addition to studying in my free time I dedicate myself to my family (especially my little daughter) and I like walking, reading, dancing and making pizza for friends and relatives.

Author

Franco Federico

Hi, I’m Franco and I was born in Monza. Over the last 20 years I worked for IBM in various roles. I started as a customer service representative (help desk operator), then I was promoted to Windows expert. In 2004 I changed again and was promoted to consultant, business analyst, then Java developer, and finally technical support and system integrator for Enterprise Content Management (FileNet). Several years ago I became fascinated by the Open Source world, the GNU\Linux operating system, and security in general. And so in the last 4 years during my free time I studied security systems and computer networks in order to extend my knowledge. I came across several open source technologies including the Elastic stack (formerly ELK), and started to explore them and other similar ones like Grafana, Greylog, Snort, Grok, etc. I like to script in Python, too. In addition to studying in my free time I dedicate myself to my family (especially my little daughter) and I like walking, reading, dancing and making pizza for friends and relatives.

Leave a Reply

Your email address will not be published. Required fields are marked *

Archive