Investigation — home lab

LAB-001 — SSH Brute Force Detection

One detection from the home lab, filed as an investigation: the captured telemetry, what the two rules mean, the order of events the capture shows, and the limits of a single lab capture.

Case data

The file

Investigation ID

LAB-001

Title

SSH Brute Force Detection

Environment

Wazuh in Docker, in a four-node home lab. The alerts fired on DC-01, the Windows Server 2022 domain controller, from its sshd authentication log. A PAM authentication failure from WEB01 appears in the same capture.

Objective

Detect repeated authentication failures.

Attack simulation

A controlled attack the subject ran himself, against his own lab. Every alert in the capture came from an attack he ran himself.

Telemetry

The capture

wazuh — docker-soc — alerts.log

TelemetryCaptured — lab attack, Oct 14, 2026

** Alert 1791978824.294411: - syslog,sshd,authentication_failed,

2026 Oct 14 02:13:44 DC-01->/var/log/auth.log

Rule: 5710 (level 5) -> 'Attempt to login using a non-existent user'

Src IP: 192.168.56.102 User: (invalid user) admin Decoder: sshd

** Alert 1791978831.294455: - syslog,sshd,authentication_failed,

2026 Oct 14 02:13:51 DC-01->/var/log/auth.log

Rule: 5712 (level 10) -> 'SSH brute force attack detected'

Src IP: 192.168.56.102 User: (invalid user) admin Decoder: sshd

** Alert 1791978903.294512: - syslog,pam,authentication_failed,

2026 Oct 14 02:15:03 WEB01->/var/log/auth.log

Rule: 5503 (level 5) -> 'PAM: User login failed.'

Src IP: 10.143.0.67 User: rmahajan Decoder: pam_unix

Transcribed from the homepage Exhibit B capture, exactly as published there.

Detection

What the rules mean

Rule 5710 — level 5

Fires when a login is attempted with a user that does not exist. In this capture the attempt was against the user “admin” on DC-01, from 192.168.56.102, decoded by sshd.

Rule 5712 — level 10

The brute-force alert. It fired from the same source IP and the same invalid user as the 5710 alert: repeated authentication failures, until the pattern itself is the event.

Investigation

The order of events

The sequence below is the order the capture shows. Nothing has been added to it.

A login attempt against the non-existent user “admin” reaches DC-01 from 192.168.56.102 and fires rule 5710 (level 5).

The same source, the same invalid user: rule 5712 (level 10) fires — SSH brute force attack detected.

In the same capture, WEB01 logs a PAM authentication failure (rule 5503, level 5).

Response

What can be stated

The attack was self-run, inside the lab, against his own machines, and the detection fired at level 10. A full incident report exists for this run — he writes one for every run — but the report is not published. It is available on request.

Result & limitations

What this proves, and what it does not

Result

Detection worked as configured: the non-existent-user attempt was logged at level 5, and the brute-force pattern alerted at level 10.

Limitations

This is a single lab capture. No production environment was involved, and the response detail lives in the unpublished per-run incident report — so this page shows the detection and the capture, and nothing past them.

Filed under: Cybersecurity — the lab this ran in is documented there, and the capture itself sits on the homepage as Exhibit B.