Brute Force Attack Log Analysis

What This Means

Comprehensive guide to detecting brute force attacks across all platforms. Learn to identify, analyze, and respond to automated password guessing attacks using log analysis techniques.

Example Log

-- Brute force indicators across multiple log sources:
[auth.log]  Failed password for root from 185.220.101.42 (50 times in 5 min)
[Event 4625] admin failed from 185.220.101.42 Type 3 (35 times in 5 min)
[IIS W3C]   POST /login 401 from 185.220.101.42 (120 times in 5 min)
[Nginx]     POST /api/auth 401 from 185.220.101.42 (80 times in 5 min)

Indicators of Suspicious Activity

• Hundreds or thousands of failed authentication attempts from a single source
• Attempts concentrated on a single account (classic brute force)
• Gradually increasing attempt frequency (attacker testing rate limits)
• Attempts using common password lists (password123, admin, letmein)
• Source IP from known hosting/VPS providers commonly used for attacks
• Attack continuing for hours or days despite failures (automated tool)

How to Investigate

1. Calculate the attack rate (attempts per minute) to assess severity
2. Identify all targeted accounts across all authentication systems
3. Check if any attempts eventually succeeded (transition from 401/4625 to 200/4624)
4. Verify the attacking IP against threat intelligence and abuse databases
5. Determine the attack method: dictionary, hybrid, pure brute force
6. Assess whether account lockout policies are in effect and working

Recommended Mitigations

• Implement rate limiting at the network edge (WAF, load balancer, firewall)
• Deploy fail2ban or equivalent on all exposed authentication services
• Enable account lockout with automatic unlock after a cooling period
• Require MFA which renders brute force attacks ineffective
• Use CAPTCHAs after 3 failed attempts on web authentication
• Implement progressive delays (1s, 2s, 4s, 8s) between failed attempts

Related Log Types

Related Attack Patterns

Frequently Asked Questions