Brute Force Detection with Azure Honeypot Logs

I deployed a Windows honeypot VM in Azure, deliberately exposed its RDP service, and collected thousands of failed logon attempts within an hour. The Windows Security Event Logs were ingested into Splunk, where I built a detection dashboard to analyse brute force behaviour.

This project demonstrates how quickly exposed systems are attacked, how brute force attempts look in the data, and how SOC analysts can monitor authentication events for early signs of compromise.

Dashboard Panels: 

• Failed Logons Over Time (4625)

o   A timeline of failed login attempts, showing how attackers hammered the system around the clock once it went online.

• Failed vs Successful Logons (4624 vs 4625)

o   Compares failed and successful attempts. In this honeypot’s case, all attacks failed, but this panel demonstrates how defenders can track brute force attempts that eventually succeed.

• Top Usernames Attempted

o   Reveals the usernames attackers attempted most frequently (e.g., Administrator, Admin, Test), reflecting common brute force tactics.

• Top Source IP Addresses

o   Identifies the most aggressive external IPs launching attacks. Useful for spotting repeat offenders and botnet-style behaviour.

Key Takeaways

• Internet-exposed systems are scanned and attacked almost immediately.

• Brute force attacks are noisy but effective if not monitored.

• Splunk makes it easy to visualise attacker behaviour in real time.

• Even a small honeypot provides real-world attack data valuable for SOC analyst training.

Lessons Learned

This exercise reinforced the importance of focusing on failed logons (4625) — one of the most critical detection points in Windows security. I also learned the value of breaking the data into “when, who, where, and outcome” — giving a complete picture of the attack activity.

And honestly, it was fun to see the dashboard light up with real attacker data. Watching automated brute force attempts come in and then turning them into visuals in Splunk made the project both educational and exciting.