WebsiteFailedLogins
1.0
This PowerShell module was created to identify the following scenarios affecting IIS hosted websites.
1. Brute Force Login Attempts - excessive failed logins from a single IP address and often targeting a single account.
2. Password Spraying Attempts - excessive failed logins from a single IP address using a single password across multiple user accounts.
3. Distribut
1. Brute Force Login Attempts - excessive failed logins from a single IP address and often targeting a single account.
2. Password Spraying Attempts - excessive failed logins from a single IP address using a single password across multiple user accounts.
3. Distribut
This PowerShell module was created to identify the following scenarios affecting IIS hosted websites.
1. Brute Force Login Attempts - excessive failed logins from a single IP address and often targeting a single account.
2. Password Spraying Attempts - excessive failed logins from a single IP address using a single password across multiple user accounts.
3. Distributed Login Attempts - either of the above techniques being sourced from multiple IP addresses.
It leverages Microsoft Logparser and a configuration file to parse the target website's IIS logs. When a threshold is met or exceeded an alert is generated via standard out, email, and/or written to a Windows Event Log. No changes are needed on the webserver. This module can even run on a separate system where there's access to the IIS logs.
Show more
1. Brute Force Login Attempts - excessive failed logins from a single IP address and often targeting a single account.
2. Password Spraying Attempts - excessive failed logins from a single IP address using a single password across multiple user accounts.
3. Distributed Login Attempts - either of the above techniques being sourced from multiple IP addresses.
It leverages Microsoft Logparser and a configuration file to parse the target website's IIS logs. When a threshold is met or exceeded an alert is generated via standard out, email, and/or written to a Windows Event Log. No changes are needed on the webserver. This module can even run on a separate system where there's access to the IIS logs.
Installation Options
Owners
Package Details
Author(s)
- phbits
Tags
IIS Logparser W3SVC Logs FailedLogin BruteForce PasswordSpray Detection
Functions
Invoke-WebsiteFailedLogins Get-WebsiteFailedLoginsReadme Copy-WebsiteFailedLoginsReadme Get-WebsiteFailedLoginsDefaultConfiguration Copy-WebsiteFailedLoginsDefaultConfiguration
Dependencies
This module has no dependencies.
Release Notes
Tested on Windows Server 2016
FileList
- WebsiteFailedLogins.nuspec
- LICENSE
- README.md
- WebsiteFailedLogins.ini
- WebsiteFailedLogins.psd1
- WebsiteFailedLogins.psm1
Version History
| Version | Downloads | Last updated |
|---|---|---|
| 2.0 | 306 | 3/13/2021 |
| 1.0 (current version) | 193 | 1/30/2019 |