Sistema escalável de resposta ativa para mitigação de ataques de força bruta em active directory com suricata

Abstract

This work addresses the development and analysis of an active response system for mitigating brute-force attacks targeting the Active Directory domain controller service. The growing sophistication of cyber threats demands solutions that not only detect but also neutralize attacks in real time. The methodology employed consisted of building a virtualized lab environment featuring an attacking machine (Kali Linux), a target (Windows Server 2022 with Active Directory), and a defense system (Ubuntu Server) positioned in an in-line network topology to act as an Intrusion Prevention System (IPS). Threat detection was performed by the Suricata security engine, configured with a custom rule to identify anomalous traffic characteristic of the attack via the Service Message Block (SMB) protocol. Mitigation was automated through a Bash script, which, when triggered by Suricata alerts, dynamically blocked the attacker’s Internet Protocol (IP) address in the system firewall. The results validated the prototype’s effectiveness, demonstrating its ability to successfully detect and block the simulated attack, thereby preventing the continuation of malicious activity. It is concluded that the proposed architecture is a viable, scalable, and cost-effective solution for protecting critical infrastructures, establishing a functional framework that can be expanded to mitigate other threats and serve as a robust alternative to high-cost commercial solutions