Project // 004 · Blue Team · SOC Operations

SSH Brute Force
Detection Lab

Full attack-to-detection pipeline: simulated a real SSH brute force attack using Hydra on Kali Linux, captured host-level evidence via auth.log, and monitored the entire event through a custom Wazuh SIEM dashboard — tracing individual alerts back to the exact detection rules that fired them.

CategoryBlue Team / SOC
ToolsWazuh · Kali · Hydra · SSH
MITRET1110 — Brute Force
Evidence7 Screenshots
StatusCompleted · 2026
01 · ATTACK
→
02 · HOST LOG
→
03 · SIEM
→
04 · ALERT
→
05–07 · RULES
01
Attack Simulation
Hydra SSH Brute Force — Kali Linux
hydra · rockyou.txt wordlist · target port 22
Hydra brute force on Kali
A brute-force attack was simulated using Hydra against the SSH service on the target system. The tool generates repeated login attempts using a password wordlist, creating high-frequency authentication failures typical of brute-force credential attacks.
02
Host-Level Evidence
auth.log — Failed Password Entries
grep "Failed password" /var/log/auth.log
auth.log grep output
The system authentication log (/var/log/auth.log) shows multiple failed SSH login attempts from a single source IP within a short timeframe, indicating automated activity. This confirms that the attack reached the host and provides raw evidence of brute-force activity.
03
SIEM Detection
Wazuh SSH Attack Monitor Dashboard
Custom dashboard · 4 visualizations · wazuh-alerts-4.x-* index
Wazuh SSH Dashboard
A custom Wazuh dashboard visualizes the attack activity, including alert volume over time and the originating IP address responsible for the activity. The spike in alerts during the attack window confirms that the SIEM successfully ingested and identified the abnormal authentication behavior.
04
Alert Investigation
Expanded Alert — Full Event Detail
rule.id · data.srcip · timestamp · MITRE ATT&CK mapping
Expanded Wazuh alert detail
Expanding an individual alert reveals key details such as the rule triggered, source IP, timestamp, and MITRE ATT&CK classification (T1110 – Brute Force). This confirms the nature of the activity and provides the necessary context to validate and investigate the threat.
05
Detection Logic
Rule 5760 — sshd: Authentication Failed
Wazuh Management → Rules → 5760
Rule 5760
Rule 5760 triggers on each failed SSH authentication attempt. During the attack, repeated failures generate a high volume of alerts, forming the base signal used to identify abnormal authentication patterns during the attack.