# SSH Brute Force Detection (lab)

> Two SSH credential attacks hit web-edge-01 on the same night: one loud campaign that failed and one quiet spray that succeeded. Triage auth.log to find the breach the volume alert missed.

Canonical: https://codelivly.com/labs/ssh-brute-force

| | |
|---|---|
| Type | Investigation |
| Difficulty | Beginner |
| Points | 200 |
| Session length | 30 min |
| Completions | 7 |

Two SSH credential attacks hit web-edge-01 on the same night: one loud campaign that failed and one quiet spray that succeeded. Triage auth.log to find the breach the volume alert missed.

## Objective

Students learn to triage SSH authentication logs by grouping failures by source, distinguishing password guessing from password spraying, and determining whether an attack actually succeeded rather than simply reporting the loudest one.

## Tasks

1. Group the failures by source
2. Characterise the high-volume campaign
3. Find the attack that actually worked
4. Classify both campaigns

## Related

- [All labs](https://codelivly.com/practice?type=lab)