Analyzing Failed Login Attempts in a Linux System, Thesis of Programming Abstractions

Download Analyzing Failed Login Attempts in a Linux System and more Thesis Programming Abstractions in PDF only on Docsity!

Course:COMP 4040 – 101 INTRODUCTION

TO SOC

NAME: DEEPIKA VERANKKI

STUDENT ID: 100548781

DATE: October 29, 2023

Lab 5 Sumo Logic Screen shots Code: _sourceCategory="linux/system" -3d "Failed" prase "Failed" as _"user:*"

Code: _sourceCategory=linux/system -3d | where _raw contains "Failed" | fields month, date, time, service, pid, username, src_ip, port, protocol

1. Create a Table (Panel01):

Code: _sourceCategory=linux/system -3d | where _raw contains "Failed" | count by username | sort by _count desc | limit 10 Build a query to count usernames.

| parse "input_userauth_request: invalid user *" as dest_user nodrop | parse "Invalid user * from * port *" as dest_user, src_host, src_port nodrop | parse "Failed publickey for * from * port * *" as dest_user, src_host, src_port, protocol nodrop | parse "Failed password for * from * port * *" as dest_user, src_host, src_port, protocol nodrop | parse "Failed password for invalid user * from * port * *" as dest_user, src_host, src_port, protocol nodrop | where dest_user!="" | count as Attempts by src_host, dest_user, dest_hostname | sort - Attempts | limit 10 | compare with timeshift 3d Create a table visualization.

Add a proper Panel Name and a detailed Panel Description.

File name: search-results-2023-10-25T09_48_27.049-0700.csv Find Top 5 Most Tried Usernames (Panel02):

Code: _sourceCategory=linux/system -3d | where _raw contains "Failed" | count by username | sort by _count desc | limit 5

Write a query to find the 5 most tried usernames.

Code: _source="Linux System" ("authentication failure" or "FAILED SU" or "input_userauth_request: invalid user" or "Invalid user" or "Failed publickey" or "Failed password") | parse regex "\d+\s+\d+:\d+:\d+\s(?<dest_hostname>\S+)\s(?<process_name>\w)(?:[|:)" nodrop | parse " user = * " as dest_user nodrop | parse "User : Authentication failure" as dest_user nodrop | parse " user=" as dest_user nodrop | parse regex "\S\s+\d+\s+\d+:\d+:\d+\s+(?<_sourceHost>\S)\s+" nodrop | parse regex "\S\s+\d+\s+\d+:\d+:\d+\s+(?<dest_hostname>\S)\s+(?[^;]+)" nodrop | parse "ruser= rhost=* user=" as src_user, src_host, dest_user nodrop | parse "ruser= rhost= user=" as src_host, dest_user nodrop | parse " user="" as dest_user nodrop | parse "Authentication failure for * from *" as dest_user, src_host nodrop | parse "FAILED SU (to *) * on" as dest_user, src_user nodrop | parse regex "FAILED LOGIN (?:SESSION|\d+) FROM (?<src_tty>\S+) FOR (?<dest_user>\S+)," nodrop | parse "input_userauth_request: invalid user *" as dest_user nodrop | parse "Invalid user * from * port *" as dest_user, src_host, src_port nodrop | parse "Failed publickey for * from * port * *" as dest_user, src_host, src_port, protocol nodrop | parse "Failed password for * from * port * *" as dest_user, src_host, src_port, protocol nodrop | parse "Failed password for invalid user * from * port * *" as dest_user, src_host, src_port, protocol nodrop | where dest_user!="" | count as Attempts by src_host, dest_user, dest_hostname | sort - Attempts | dedup dest_user |limit 5

Add a proper Panel Name and a detailed Panel Description.

Write a query to visualize failed attempts every 30 minutes. Code: _source="Linux System" ("authentication failure" or "FAILED SU" or "input_userauth_request: invalid user" or "Invalid user" or "Failed publickey" or "Failed password") | parse regex "\d+\s+\d+:\d+:\d+\s(?<dest_hostname>\S+)\s(?<process_name>\w)(?:[|:)" nodrop | parse " user = * " as dest_user nodrop | parse "User : Authentication failure" as dest_user nodrop | parse " user=" as dest_user nodrop | parse regex "\S\s+\d+\s+\d+:\d+:\d+\s+(?<_sourceHost>\S)\s+" nodrop | parse regex "\S\s+\d+\s+\d+:\d+:\d+\s+(?<dest_hostname>\S)\s+(?[^;]+)" nodrop | parse "ruser= rhost=* user=" as src_user, src_host, dest_user nodrop | parse "ruser= rhost= user=" as src_host, dest_user nodrop | parse " user="" as dest_user nodrop | parse "Authentication failure for * from *" as dest_user, src_host nodrop

| parse "FAILED SU (to *) * on" as dest_user, src_user nodrop | parse regex "FAILED LOGIN (?:SESSION|\d+) FROM (?<src_tty>\S+) FOR (?<dest_user>\S+)," nodrop | parse "input_userauth_request: invalid user *" as dest_user nodrop | parse "Invalid user * from * port *" as dest_user, src_host, src_port nodrop | parse "Failed publickey for * from * port * *" as dest_user, src_host, src_port, protocol nodrop | parse "Failed password for * from * port * *" as dest_user, src_host, src_port, protocol nodrop | parse "Failed password for invalid user * from * port * *" as dest_user, src_host, src_port, protocol nodrop | where dest_user!="" |timeslice 30m | count as Attempts by src_host, dest_user, dest_hostname,_timeslice | sort - Attempts|dedup dest_user Create a line chart to represent this data.