incident-response-project-/investigation-commands.txt at main · archana6malviya/incident-response-project- · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
========================================
INVESTIGATION COMMANDS – SSH BRUTE FORCE
========================================

Purpose:
These commands were used to investigate an SSH brute-force attack
by analyzing Linux authentication logs.

----------------------------------------
1. Verify SSH Service Status
----------------------------------------
sudo systemctl status ssh

----------------------------------------
2. View Full Authentication Log
----------------------------------------
sudo less /var/log/auth.log

----------------------------------------
3. Identify Failed SSH Login Attempts
----------------------------------------
sudo grep "Failed password" /var/log/auth.log

----------------------------------------
4. Extract Source IP Addresses
----------------------------------------
sudo grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}'

----------------------------------------
5. Count Failed Attempts Per IP
----------------------------------------
sudo grep "Failed password" /var/log/auth.log | awk '{print $(NF-3)}' | sort | uniq -c | sort -nr

----------------------------------------
6. Identify Targeted Usernames
----------------------------------------
sudo grep "Failed password" /var/log/auth.log | awk '{print $(NF-5)}' | sort | uniq -c | sort -nr

----------------------------------------
7. Check for Successful SSH Logins
----------------------------------------
sudo grep "Accepted password" /var/log/auth.log

----------------------------------------
8. Filter Logs by Specific IP
----------------------------------------
sudo grep "<MALICIOUS_IP>" /var/log/auth.log

----------------------------------------
9. Check Login Attempts Timeline
----------------------------------------
sudo grep "Failed password" /var/log/auth.log | head
sudo grep "Failed password" /var/log/auth.log | tail

----------------------------------------
10. Block Malicious IP (Containment)
----------------------------------------
sudo ufw deny from <MALICIOUS_IP>

----------------------------------------
End of Investigation Commands
----------------------------------------