SIMULATED TRAINING CASE · SOC-003 · SSH authentication anomaly
Simulated SSH authentication failures
An external documentation-range source makes repeated SSH authentication attempts against a fictional Linux host. The available evidence supports attempted password guessing, not confirmed compromise.
SIMULATED · NOT A REAL INCIDENTINITIAL SEVERITY: MEDIUMInvestigation brief
Objective
Determine what the provided evidence supports, what remains unknown, and which next steps are proportionate.
Evidence scope
A deliberately small synthetic sample. There is no endpoint access, full SIEM dataset or independent threat intelligence.
Analyst posture
Validate the signal, seek corroboration, document confidence and avoid treating indicators as identities.
Evidence timeline
| Time (UTC) | Observed training event |
|---|---|
| 14:02:11 | Failed password for invalid user admin from 203.0.113.42 port 51244 ssh2 |
| 14:02:18 | Failed password for root from 203.0.113.42 port 51248 ssh2 |
| 14:02:24 | Failed password for invalid user ubuntu from 203.0.113.42 port 51254 ssh2 |
| 14:03:04 | Detection rule: 3 failures from one source within 60 seconds |
Sample log extract
14:02:11 Failed password for invalid user admin from 203.0.113.42 port 51244 ssh2 14:02:18 Failed password for root from 203.0.113.42 port 51248 ssh2 14:02:24 Failed password for invalid user ubuntu from 203.0.113.42 port 51254 ssh2 14:03:04 Detection rule: 3 failures from one source within 60 seconds
Findings and limitations
Supported assessment
No successful authentication appears in this limited sample. Absence from the sample does not prove no compromise occurred elsewhere.
Recommended next steps
Check complete authentication logs and successful sessions; verify source is not authorised testing; rate-limit SSH and enforce key-based authentication where appropriate.
Learning outcomes
This exercise demonstrates a repeatable SOC workflow: validate the detection, construct a timeline, identify missing evidence, assess risk and recommend proportionate actions. The narrative is a worked training example, not a report from an actual incident.