Potential Successful Linux FTP Brute Force Attack Detected

edit

Potential Successful Linux FTP Brute Force Attack Detected

edit

An FTP (file transfer protocol) brute force attack is a method where an attacker systematically tries different combinations of usernames and passwords to gain unauthorized access to an FTP server, and if successful, the impact can include unauthorized data access, manipulation, or theft, compromising the security and integrity of the server and potentially exposing sensitive information. This rule identifies multiple consecutive authentication failures targeting a specific user account from the same source address and within a short time interval, followed by a successful authentication.

Rule type: eql

Rule indices:

  • auditbeat-*
  • logs-auditd_manager.auditd-*

Severity: medium

Risk score: 47

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References: None

Tags:

  • Domain: Endpoint
  • OS: Linux
  • Use Case: Threat Detection
  • Tactic: Credential Access

Version: 3

Rule authors:

  • Elastic

Rule license: Elastic License v2

Rule query

edit
sequence by host.id, auditd.data.addr, related.user with maxspan=5s
  [authentication where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and
   event.action == "authenticated" and auditd.data.terminal == "ftp" and event.outcome == "failure" and
   auditd.data.addr != null and auditd.data.addr != "0.0.0.0" and auditd.data.addr != "::"] with runs=10
  [authentication where host.os.type == "linux" and event.dataset == "auditd_manager.auditd" and
   event.action  == "authenticated" and auditd.data.terminal == "ftp" and event.outcome == "success" and
   auditd.data.addr != null and auditd.data.addr != "0.0.0.0" and auditd.data.addr != "::"] | tail 1

Framework: MITRE ATT&CKTM