[New Rule] Linux Local Account Brute Force

[Aegrah]

Summary

Identifies multiple consecutive login attempts executed by one process targeting a local linux user account within a short time interval. Adversaries might brute force login attempts across different users with a default wordlist or a set of customly crafted passwords in an attempt to gain access to these accounts.

Detection

This behavior is common across different local account brute force scripts e.g. https://github.com/carlospolop/su-bruteforce or manual attempts of brute forcing a useraccount. As new process.entity_id's and process.parent.entity_id's are generated per authentication attempt, the only feasible way of detecting this is through the process.parent.executable. As the timespan is set to 1 second, this shouldn't be a big performance hit.

Red sector shows 0 hits for this query in the last year. 10 authentication attemps should not occur in 1 second unless a brute force is being executed.

sequence by host.id, process.parent.executable, user.name with maxspan=1s
[ process where host.os.type == "linux" and event.type == "start" and 
  event.action == "exec" and process.name == "su" ] with runs=10

[eric-forte-elastic]

👍 su 10 times in one second should never happen.