analysis

3 Pages
1 Sections
1 Types

November 21, 2023 3 min read Domains

Detect an SSH login after social engineering

ssh logs analysis challenge visualization parallel coordinates

In this article, we are addressing the challenge presented by detecteam.com. “We have published one year of ssh logins/logouts of a valid administrator; However the account has been compromised using social engineering similar to the MGM attack which led to a ransomware being deployed.” ― Detecteam So here is the openssh.log_.zip (mirror) dataset and its associated openssh.log_.zip.format parsing file. It’s looking like typical OpenSSH logs: Sep 24 08:46:18 bidizidomo sshd[26168]: Accepted password for iworkinacasino from 173.

September 22, 2023 1 min read Domains

Phishing attack detection in proxy logs

proxy logs analysis forensics visualization parallel coordinates video

Here is a video of the detection of a successful phishing attack contained in a 10 million rows anonymized proxy logs.

July 29, 2023 9 min read Domains

Bluecoat Proxy Big Analysis

proxy logs analysis visualization parallel coordinates

This article is a step-by-step tutorial aiming at loading and analyzing the bluecoat_proxy_big.zip dataset from Public Security Log Sharing in Squey. The first section is devoted the creation of a parsing file that will allow us to load the dataset. Should you be in a hurry, you can skip straight to the analysis as the file is provided below. Parsing file creation Before being able to load the dataset into the application, a parsing file (called format) should be created using the Format Builder tool.