Lion Cipher Lab
Read Splunk authentication results: brute force, spraying, and the login that shouldn't have worked
- SOC Analyst / Blue Team
- Intermediate
- ~35 min
- Free · no account required
Why it matters
Stolen and guessed passwords are still one of the most common ways attackers get in, and the evidence lands in your authentication logs as thousands of dull success/failure lines. A SOC analyst's real job is not writing fancy searches — it is looking at a results table and correctly saying 'that is a brute-force attempt on one account', 'that is a spray across the whole company', or 'that failure-then-success is an account that just got taken over'. Get the reading wrong and you either page the on-call for a user who fat-fingered their password, or you wave past the one login that mattered.…
What you'll learn
- reading a Splunk stats/timechart results table over authentication events
- following the SPL that produced it (stats count by user, action; timechart; where count > N)
- spotting a brute-force spike: one source, many failures, one target account
- spotting password spraying: one source, few failures each, spread across many accounts
- recognising the failure-to-success pivot as the highest-value signal in the table
- turning a reading into a detection threshold (count over a time window) and an alert
- ruling out the classic false positive: a service account with a stale password
- judgment: when a per-account threshold is enough and when spraying defeats it
Steps in this lab
- The scenario, and the three things hiding in one table
- The SPL that builds the table — explained line by line
- The results table — read it before you read the analysis
- Story one — the brute-force spike (rows A and I)
- Story two — password spraying, the quiet one (rows B–G)
- The false positive you must survive — row H
- See the timing — timechart, and why the pivot needs it
- Turn the reading into a detection — threshold, then the smarter version
- What you actually learned