Network investigation guide
Investigating Login Brute-Force Attempts
Login brute-force activity is a rapid series of connection attempts to a password-protected service that resembles repeated rejected sign-ins.
Understand the finding
What do Login Brute-Force Attempts mean?
A successful attempt can give an attacker direct access to a service or host. Network traffic can identify the pattern, but authentication logs are needed to distinguish failed logins from applications that merely produce similar traffic.
Triage workflow
How to investigate Login Brute-Force Attempts
- 1
Review authentication logs for failures, targeted accounts, lockouts, and any later success.
- 2
Identify the source host, process, user, and direction of the attempts.
- 3
Determine the privilege and exposure of the targeted service.
- 4
Check for access, privilege changes, or lateral movement after the attempt sequence.
Interpret the context
Common benign explanations
Finding this behavior does not by itself prove malicious intent. Common explanations include:
- An application retrying stale, expired, or incorrect saved credentials
- A locked-out user device repeatedly reconnecting
- Health checks, small queries, sanctioned scanners, or penetration tests
Make a decision
When to escalate or de-escalate
Escalate when
- A successful login follows repeated failures, especially from a new source.
- Privileged accounts or externally exposed administrative services are targeted.
De-escalate when
- Authentication and application logs confirm a known stale-credential problem.
- The source and timing match an approved security test.
Analyze the evidence
Investigate network behavior with Red Hand Analytics
Upload a PCAP or connect Red Hand Collector. Both use Red Hand Analytics, where meaningful behavior, endpoints, DNS, data flows, and connection evidence stay connected.