Lion Cipher Lab
Detect the brute force you just ran: turn your own Hydra run into a detection
- SOC Analyst / Blue Team
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Every intrusion that starts with guessed credentials leaves the same fingerprint in the logs — a pile of failed logons — and the single most valuable thing a junior SOC analyst can do is read that fingerprint correctly and write it down as a repeatable detection. This is the other half of the attack you already ran: in the Hydra lab you made the noise; here you learn to see it, and to see the two ways it can hide from you. The lab is built around one hard, career-relevant idea most beginners get wrong — that a naive 'lock the account after 5 failures' rule catches a loud brute force and is…
What you'll learn
- finding failed-logon evidence on Linux (/var/log/auth.log, /var/log/secure, journalctl -u ssh) and Windows (Security event IDs 4625/4624/4740)
- reading Windows Logon Type (3 network vs 10 RDP) to turn a raw failure into an actual story
- the core blue-team triage pipeline: grep | awk | sort | uniq -c | sort -rn to rank sources and targets by failure count
- stating a detection properly: N failures over M minutes from one source, and against one account vs many
- distinguishing BRUTE FORCE (many passwords, one account) from PASSWORD SPRAYING (one password, many accounts) — and why a per-account threshold misses the spray entirely
- writing the detection as a portable Sigma rule, plus a fail2ban / host equivalent
- the pro move: alerting on the failure-to-success transition, not failures alone; aggregating by source AND by account; tuning against your own baseline before you ship
- responding without shooting yourself in the foot: lockout-as-DoS, NIST rate-limiting over hard lockout, and MFA as the control that actually ends the attack
- telling a real slow brute force apart from a benign false positive (a stale saved password on someone's phone)
Steps in this lab
- The situation: you already made the noise — now find it
- Where the evidence lands — Linux and Windows
- The one Windows field that separates a story from a guess: Logon Type
- Find it by hand on Linux — the single most useful pipeline in blue team work
- The same question on Windows — Event Viewer and Get-WinEvent
- State the detection properly — threshold, window, and the spray trap
- Do it better — alert on the failure-to-SUCCESS transition, not failures alone
- Write the detection down where it travels — a Sigma rule
- The host / network equivalents — fail2ban, and why logs beat the wire here
- Respond — and don't hand the attacker a DoS switch
- The false positive that will bite you — and how to tell it apart
- When a threshold is enough, when it isn't, and what you actually learned