# How do we know if someone is guessing passwords on our internal network?

Look in two places: the logs of the target and the pattern on the network. The target's logs, on a file server, a remote desktop host, an SSH server or the domain controller, show the failed logins themselves and the account names tried; many failures across many accounts from one source is password spraying, many for one account is brute force. The network shows the source: one host making repeated short connections to a login service, often on several servers. Remote desktop or SSH brute force inside the LAN is not normal; it means a compromised machine or an unauthorised test. Lock out or slow down repeated failures, require multi-factor authentication (MFA) where you can, and investigate the source host. NetSenX sees the repeated connections between hosts on monitored segments and flags the scanning and lateral movement that typically go with them; the count of failed logins lives in the server's log.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/how-to-know-if-someone-is-guessing-passwords-internally

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [How do we detect large uploads to cloud storage from a server?](https://netsenx.com/en/faq/how-to-detect-large-uploads-to-cloud-storage-from-a-server)
- [What is PsExec or admin-share abuse, and why does antivirus not flag it?](https://netsenx.com/en/faq/what-is-psexec-and-admin-share-abuse)
- [Can attackers move through our network with stolen passwords and no malware?](https://netsenx.com/en/faq/can-attackers-move-with-stolen-passwords-and-no-malware)
- [Should we detect lateral movement from authentication logs or from network flows?](https://netsenx.com/en/faq/authentication-logs-or-network-flows-for-lateral-movement)
- [What is graph-based detection of lateral movement?](https://netsenx.com/en/faq/what-is-graph-based-lateral-movement-detection)