This challenge involves analyzing SSH logs to investigate suspicious activity. The objective is to identify the attacker, determine how access was gained, and extract key forensic details from the log file.
A system running an SSH service experienced an unusual increase in log file size. The logs were provided for analysis to determine whether the activity was malicious.
Command:
cat sshlog.log | grep -i “connection from”
Finding:
The attacker originated from a private IP address, indicating lateral movement or insider activity.
Commands:
cat sshlog.log | grep -i “userauth” | cut -d “ “ -f 8 | sort -u
cat sshlog.log | grep “does not exist” | cut -d “ “ -f 13 | sort -u
Finding:
The attacker performed username enumeration to identify valid accounts.
Command:
cat sshlog.log | grep “Accepted password”
Finding:
This confirms the attacker successfully authenticated to the system.
Command:
cat sshlog.log | grep -i “connection from”
Finding:
This marks the initial access attempt.
Command:
cat sshlog.log
Finding:
The debug level provided detailed logging, which assisted in the investigation.
Path:
C:\ProgramData\ssh\logs\sshd.log
The investigation shows an internal attacker enumerated users, identified a valid account, and successfully logged in multiple times via SSH. This demonstrates the risk of weak credentials and lack of monitoring on internal network activity. Proper logging, alerting, and account security controls are critical to detect and prevent similar incidents.