LetsDefend Brute Force Challenge | SSH & RDP Attack Analysis (SOC Level 1) скачать в хорошем качестве

LetsDefend Brute Force Challenge | SSH & RDP Attack Analysis (SOC Level 1)

In this video, we complete the Brute Force challenge on the LetsDefend platform, focusing on real SOC-level investigation techniques using logs and packet captures. This challenge simulates an attacker performing brute-force attacks over SSH and RDP, and our job as a SOC analyst is to identify the scope, impact, and technique used — using evidence, not guesswork. 🔍 Investigation Overview The challenge was solved by analysing: Network traffic in Wireshark (PCAP) Authentication logs (auth.log) Manual log correlation using grep Mapping attacker behaviour to MITRE ATT&CK 🧠 Key Questions Answered Targeted server IP address Directory targeted during brute-force attempts Successful username and password combination Number of user accounts targeted via RDP brute-force Attacker machine clientName Last successful SSH login (user + time) Total number of failed SSH authentication attempts MITRE ATT&CK technique used to gain access 🧪 Tools & Techniques Used Wireshark for PCAP traffic analysis Linux log analysis using auth.log grep for filtering SSH authentication events Timeline correlation between network and host logs MITRE ATT&CK technique identification 🎯 What You’ll Learn How SOC analysts detect brute-force attacks Differentiating SSH vs RDP brute-force activity Identifying successful vs failed authentication attempts Correlating PCAP data with host-based logs Mapping brute-force activity to MITRE ATT&CK 📌 Challenge Details Platform: LetsDefend Category: Brute Force / Authentication Attacks Focus: SSH & RDP Skill Level: SOC Level 1 / Blue Team This walkthrough is ideal for entry-level SOC analysts, blue team learners, and anyone preparing for log-based attack investigations in real SOC environments. 🔐 Disclaimer For educational and defensive security purposes only. #SOC #LetsDefend #BruteForce #SOCLevel1 #BlueTeam #SSH #RDP #Wireshark #PCAPAnalysis #LogAnalysis #MITREATTACK #DFIR #CyberSecurity