LoFP LoFP / an administrator who mistypes the root password in the host client a few times can reach three failures. confirm the source address is a known workstation and that a successful login did not follow.

Techniques

Sample rules

ESXi Multiple Logon Failures by User and Source

Description

Detects three or more failed ESXi logons for the same account from the same remote address within 10 minutes. Hostd records each failure from pam_do_authenticate with the login name and rhost. Repeated failures from one source are password guessing against that account and can lock it or come just before a successful login.

Detection logic

FROM logs-vsphere.log-*
| WHERE data_stream.dataset == "vsphere.log" AND event.module == "vsphere"
    AND message LIKE "*pam_do_authenticate: error*"
| GROK message "%{DATA}rhost=%{IP:source_ip}%{DATA}login:%{DATA:user}]%{GREEDYDATA}"
| WHERE user IS NOT NULL AND source_ip IS NOT NULL
| EVAL user.name = user, source.ip = source_ip
| STATS
    Esql.failure_count = COUNT(*),
    Esql.first_seen = MIN(@timestamp),
    Esql.last_seen = MAX(@timestamp),
    Esql.message_values = VALUES(message)
  BY user.name, source.ip, host.ip
| WHERE Esql.failure_count >= 3
| EVAL message = MV_FIRST(Esql.message_values)
| KEEP message, user.name, source.ip, host.ip, Esql.failure_count, Esql.first_seen, Esql.last_seen, Esql.message_values