How can I find if intruders has attacked on my Azure VM's

Alex Dud 1 Reputation point
2020-04-20T12:37:50.497+00:00

Hi Team,

We have been reported of a brute force attack targeting 2 servers. This has been happening since at least march 8th.

More than 3500 unique usernames were observed being used.

Please note that there isn’t any evidence that points to attack being successful; all observed events were unsuccessful login attempts. as reported by our Cyber Defense team.

Azure Virtual Machines
Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
8,795 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. Alan Kinane 16,951 Reputation points MVP Moderator
    2023-02-21T17:10:10.0833333+00:00

    If it's a Windows VM you could monitor the Windows security audit logs for failed sign in attempts.

    I wrote a blog post on this a few years back - https://azurealan.ie/2019/11/12/monitoring-failed-login-attempts-to-your-azure-virtual-machines/

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.