17:07:51
Initial failed SSH login detected against the Ubuntu target endpoint.
Incident Report
SSH Brute Force Detection
Wazuh SIEM Investigation • IR-2026-002
Investigation of repeated failed SSH authentication attempts detected by Wazuh against a monitored Ubuntu Server in a controlled home lab environment.
Case Summary
Incident Details
Medium
Severity
Closed
Status
Wazuh
SIEM Platform
T1110.001
Password Guessing
Executive Summary
Wazuh detected repeated failed SSH authentication attempts originating from a Kali Linux attacker system against a monitored Ubuntu Server. The activity included multiple username attempts, which indicated password guessing rather than normal user error.
No successful authentication was identified. The incident was classified as a medium-severity credential access attempt and closed after confirming that no compromise, persistence, or privilege escalation occurred.
Timeline
Investigation Timeline
Repeated Attempts
Additional failed SSH authentication attempts observed from the same source host.
Username Changes
Attempts included usernames such as clinton, administrator, and testuser.
Incident Closed
No successful login, persistence, or privilege escalation activity was identified.
Indicators
Indicators of Compromise
MITRE ATT&CK
Technique Mapping
Analyst Investigation
Review of the Wazuh alerts and Linux authentication activity showed repeated failed login attempts from a single source host. The use of multiple usernames increased confidence that the activity was malicious password guessing rather than a normal user mistyping a password.
The investigation did not identify any successful SSH login from the attacker system. No follow-on activity, privilege escalation, persistence, or lateral movement was observed.
Containment
Recommended containment actions include blocking the source IP if activity continues, reviewing SSH access policy, enabling Fail2Ban, and enforcing strong authentication controls.
Recovery
No recovery actions were required because the attacker did not successfully authenticate or gain access to the system.
Lessons Learned
Repeated failed logins from a single source, especially against multiple usernames, should be treated as suspicious and investigated quickly.
Skills Demonstrated
Wazuh SIEM analysis, Linux authentication log review, SSH monitoring, MITRE ATT&CK mapping, IOC identification, and incident documentation.