{"id":208349,"date":"2023-09-27T06:45:32","date_gmt":"2023-09-27T06:45:32","guid":{"rendered":"https:\/\/www.ninjaone.com\/script-hub\/detecter-les-attaques-de-force-brute-avec-powershell\/"},"modified":"2024-03-04T16:43:09","modified_gmt":"2024-03-04T16:43:09","slug":"detecter-les-attaques-de-force-brute-avec-powershell","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/fr\/script-hub\/detecter-les-attaques-de-force-brute-avec-powershell\/","title":{"rendered":"D\u00e9tecter et pr\u00e9venir les attaques par force brute avec PowerShell"},"content":{"rendered":"

Si les cybermenaces \u00e9voluent sans cesse, il n’en reste pas moins que la plupart des intrusions s’appuient sur des techniques de base qui ont fait leurs preuves. Qui a besoin d’un zero-day si le fait deviner des mots de passe couramment utilis\u00e9s ou exploiter des mots de passe utilis\u00e9s sur plusieurs comptes vous permet d’acc\u00e9der facilement \u00e0 l’information ?<\/p>\n

Les attaques par force brute restent une menace incroyablement courante pour les entreprises. Il est essentiel de d\u00e9tecter et de bloquer ces tentatives le plus rapidement possible, car elles sont souvent le signe avant-coureur d’activit\u00e9s plus dommageables et de tentatives d’acc\u00e8s malveillant \u00e0 venir. Parce que chaque minute compte dans ces situations, la mise en place de strat\u00e9gies de verrouillage des comptes et d’alertes en temps r\u00e9el en cas de tentatives de connexion infructueuses constitue une mesure de dissuasion et d’alerte pr\u00e9coce extr\u00eamement importante.<\/p>\n

Mais qu’en est-il de la d\u00e9tection des attaques par force brute<\/strong> sur l’ensemble d’un r\u00e9seau d’entreprise, \u00e0 distance et \u00e0 grande \u00e9chelle ?<\/p>\n

Parce que cela peut \u00eatre un d\u00e9fi, nous avons fourni le script suivant que les administrateurs peuvent utiliser pour automatiser le processus, en surveillant les tentatives de connexion \u00e9chou\u00e9es<\/a> et en d\u00e9clenchant des alertes bas\u00e9es sur des seuils personnalisables.<\/p>\n

Script de d\u00e9tection et de pr\u00e9vention des attaques par force brute<\/h2>\n

#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n    Condition for helping detect brute force login attempts.\r\n.DESCRIPTION\r\n    Condition for helping detect brute force login attempts.\r\n.EXAMPLE\r\n     -Hours 10\r\n    Number of hours back in time to look through in the event log.\r\n    Default is 1 hour.\r\n.EXAMPLE\r\n    -Attempts 100\r\n    Number of login attempts to trigger at or above this number.\r\n    Default is 8 attempts.\r\n.OUTPUTS\r\n    PSCustomObject[]\r\n.NOTES\r\n    Minimum OS Architecture Supported: Windows 10, Windows Server 2016\r\n    Release Notes:\r\n    Initial Release\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    [Parameter()]\r\n    [int]\r\n    $Hours = 1,\r\n    [Parameter()]\r\n    [int]\r\n    $Attempts = 8\r\n)\r\n\r\nbegin {\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n    }\r\n    function Test-StringEmpty {\r\n        param([string]$Text)\r\n        # Returns true if string is empty, null, or whitespace\r\n        process { [string]::IsNullOrEmpty($Text) -or [string]::IsNullOrWhiteSpace($Text) }\r\n    }\r\n    if (-not $(Test-StringEmpty -Text $env:Hours)) {\r\n        $Hours = $env:Hours\r\n    }\r\n    if (-not $(Test-StringEmpty -Text $env:Attempts)) {\r\n        $Attempts = $env:Attempts\r\n    }\r\n}\r\nprocess {\r\n    if (-not (Test-IsElevated)) {\r\n        Write-Error -Message \"Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n\r\n    if ($(auditpol.exe \/get \/category:* | Where-Object { $_ -like \"*Logon*Success and Failure\" })) {\r\n        Write-Information \"Audit Policy for Logon is set to: Success and Failure\"\r\n    }\r\n    else {\r\n        Write-Error \"Audit Policy for Logon is NOT set to: Success and Failure\"\r\n        exit 1\r\n        # Write-Host \"Setting Logon to: Success and Failure\"\r\n        # auditpol.exe \/set \/subcategory:\"Logon\" \/success:enable \/failure:enable\r\n        # Write-Host \"Future failed login attempts will be captured.\"\r\n    }\r\n\r\n    $StartTime = (Get-Date).AddHours(0 - $Hours)\r\n    $EventId = 4625\r\n\r\n    # Get failed login attempts\r\n    try {\r\n        $Events = Get-WinEvent -FilterHashtable @{LogName = \"Security\"; ID = $EventId; StartTime = $StartTime } -ErrorAction Stop | ForEach-Object {\r\n            $Message = $_.Message -split [System.Environment]::NewLine\r\n            $Account = $($Message | Where-Object { $_ -Like \"*Account Name:*\" }) -split 's+' | Select-Object -Last 1\r\n            [int]$LogonType = $($Message | Where-Object { $_ -Like \"Logon Type:*\" }) -split 's+' | Select-Object -Last 1\r\n            $SourceNetworkAddress = $($Message | Where-Object { $_ -Like \"*Source Network Address:*\" }) -split 's+' | Select-Object -Last 1\r\n            [PSCustomObject]@{\r\n                Account              = $Account\r\n                LogonType            = $LogonType\r\n                SourceNetworkAddress = $SourceNetworkAddress\r\n            }\r\n        } | Where-Object { $_.LogonType -in @(2, 7, 10) }\r\n    }\r\n    catch {\r\n        if ($_.Exception.Message -like \"No events were found that match the specified selection criteria.\") {\r\n            Write-Host \"No failed logins found in the past $Hours hour(s).\"\r\n            exit 0\r\n        }\r\n        else {\r\n            Write-Error $_\r\n            exit 1\r\n        }\r\n    }\r\n\r\n    # Build a list of accounts \r\n    $UsersAccounts = [System.Collections.Generic.List[String]]::new()\r\n    try {\r\n        $ErrorActionPreference = \"Stop\"\r\n        Get-LocalUser | Select-Object -ExpandProperty Name | ForEach-Object { $UsersAccounts.Add($_) }\r\n        $ErrorActionPreference = \"Continue\"\r\n    }\r\n    catch {\r\n        $NetUser = net.exe user\r\n        $(\r\n            $NetUser | Select-Object -Skip 4 | Select-Object -SkipLast 2\r\n            # Join each line with a \",\"\r\n            # Replace and spaces with a \",\"\r\n            # Split everything by \",\"\r\n        ) -join ',' -replace 's+', ',' -split ',' |\r\n            # Sort and remove any duplicates\r\n            Sort-Object -Descending -Unique |\r\n            # Filter out empty strings\r\n            Where-Object { -not [string]::IsNullOrEmpty($_) -and -not [string]::IsNullOrWhiteSpace($_) } |\r\n            ForEach-Object {\r\n                $UsersAccounts.Add($_)\r\n            }\r\n    }\r\n    $Events | Select-Object -ExpandProperty Account | ForEach-Object { $UsersAccounts.Add($_) }\r\n\r\n    $Results = $UsersAccounts | Select-Object -Unique | ForEach-Object {\r\n        $Account = $_\r\n        $AccountEvents = $Events | Where-Object { $_.Account -like $Account }\r\n        $AttemptCount = $AccountEvents.Count\r\n        $SourceNetworkAddress = $AccountEvents | Select-Object -ExpandProperty SourceNetworkAddress -Unique\r\n        if ($AttemptCount -gt 0) {\r\n            [PSCustomObject]@{\r\n                Account              = $Account\r\n                Attempts             = $AttemptCount\r\n                SourceNetworkAddress = $SourceNetworkAddress\r\n            }\r\n        }\r\n    }\r\n\r\n    # Get only the accounts with fail login attempts at or over $Attempts\r\n    $BruteForceAttempts = $Results | Where-Object { $_.Attempts -ge $Attempts }\r\n    if ($BruteForceAttempts) {\r\n        $BruteForceAttempts | Out-String | Write-Host\r\n        exit 1\r\n    }\r\n    $Results | Out-String | Write-Host\r\n    exit 0\r\n}\r\nend {\r\n    $ScriptVariables = @(\r\n        [PSCustomObject]@{\r\n            name           = \"Hours\"\r\n            calculatedName = \"hours\" # Must be lowercase and no spaces\r\n            required       = $false\r\n            defaultValue   = [PSCustomObject]@{ # If not default value, then remove\r\n                type  = \"TEXT\"\r\n                value = \"1\"\r\n            }\r\n            valueType      = \"TEXT\"\r\n            valueList      = $null\r\n            description    = \"Number of hours back in time to look through in the event log.\"\r\n        }\r\n        [PSCustomObject]@{\r\n            name           = \"Attempts\"\r\n            calculatedName = \"attempts\" # Must be lowercase and no spaces\r\n            required       = $false\r\n            defaultValue   = [PSCustomObject]@{ # If not default value, then remove\r\n                type  = \"TEXT\"\r\n                value = \"8\"\r\n            }\r\n            valueType      = \"TEXT\"\r\n            valueList      = $null\r\n            description    = \"Number of login attempts to trigger at or above this number.\"\r\n        }\r\n    )\r\n}<\/pre>\n
 <\/p>\n
\n
Acc\u00e9dez \u00e0 plus de 700 scripts dans le Dojo NinjaOne<\/p>\n
Obtenez l’acc\u00e8s<\/a><\/p>\n<\/div><\/p>\n
Comprendre et utiliser le script<\/h2>\n
Notre script repose sur deux param\u00e8tres principaux : Heure (-Hours) et Tentatives (-Attempts). Le param\u00e8tre `-Hours` d\u00e9termine la p\u00e9riode \u00e0 examiner dans le journal des \u00e9v\u00e9nements (1 heure par d\u00e9faut). Le param\u00e8tre `-Attempts` d\u00e9finit le seuil de tentatives de connexion avant de d\u00e9clencher une alerte (la valeur par d\u00e9faut est de 8 tentatives).<\/p>\n
Pour installer et ex\u00e9cuter le script, proc\u00e9dez comme suit :<\/h3>\n
    \n
  1.  Ouvrez PowerShell avec les privil\u00e8ges de l’administrateur.<\/span><\/li>\n
  2.  Copiez le script dans votre environnement PowerShell.<\/span><\/li>\n
  3.  Personnalisez les param\u00e8tres `-Hours` et `-Attempts` selon vos besoins.<\/span><\/li>\n
  4.  Ex\u00e9cutez le script.<\/span><\/li>\n<\/ol>\n
    Le script \u00e9value ensuite les journaux d’\u00e9v\u00e9nements en fonction des param\u00e8tres fournis. Si le nombre de tentatives de connexion infructueuses d\u00e9passe le seuil fix\u00e9 dans le d\u00e9lai sp\u00e9cifi\u00e9, le syst\u00e8me vous avertit d’une \u00e9ventuelle attaque par force brute.<\/span>\u00a0<\/span><\/p>\n
    Prenons l’exemple d’une personne qui souhaite surveiller les tentatives de connexion au cours des trois derni\u00e8res heures et qui souhaite recevoir une alerte si plus de 15 tentatives \u00e9chouent. Avec NinjaOne, vous avez la possibilit\u00e9 de personnaliser votre approche de la s\u00e9curit\u00e9 en ex\u00e9cutant le script avec des param\u00e8tres personnalis\u00e9s tels que -Hours 3 -Attempts 15. Cette fonction vous permet de vous adapter aux besoins de s\u00e9curit\u00e9 uniques et aux profils de risque de votre entreprise.<\/span><\/p>\n
    Mesures de s\u00e9curit\u00e9 suppl\u00e9mentaires<\/h2>\n
    La d\u00e9tection des attaques par force brute n’est qu’un <\/span>\u00e9l\u00e9ment<\/span> d’une strat\u00e9gie globale de cybers\u00e9curit\u00e9. D’autres mesures cruciales sont n\u00e9cessaires :<\/span><\/span>\u00a0<\/span><\/p>\n
      \n
    1.  Des mots de passe forts :<\/span><\/b> Encouragez les utilisateurs \u00e0 cr\u00e9er des mots de passe robustes et uniques; id\u00e9alement un m\u00e9lange de lettres, de chiffres et de symboles. Les gestionnaires de mots de passe peuvent faciliter la <\/span>la gestion de mots de passe complexes<\/span><\/a>.<\/span><\/li>\n<\/ol>\n
        \n
      1. Authentification multifactorielle (AMF) :<\/span><\/b> L’AMF fournit une couche suppl\u00e9mentaire de s\u00e9curit\u00e9, exigeant des utilisateurs qu’ils v\u00e9rifient leur identit\u00e9 \u00e0 l’aide de deux m\u00e9canismes ou plus (par exemple, quelque chose qu’ils connaissent, quelque chose qu’ils ont, ou quelque chose qu’ils sont).<\/span><\/li>\n<\/ol>\n
          \n
        1. Mises \u00e0 jour logiciel :<\/span><\/b> La mise \u00e0 jour r\u00e9guli\u00e8re des logiciels est essentielle. Les mises \u00e0 jour comprennent souvent <\/span>des correctifs pour les failles de s\u00e9curit\u00e9<\/span><\/a> qui, si elles ne sont pas corrig\u00e9es, peuvent ouvrir la voie \u00e0 des cyber-attaques.<\/span><\/li>\n<\/ol>\n
            \n
          1. Formation des employ\u00e9s<\/span><\/b>: La mise en place d’un programme de sensibilisation \u00e0 la s\u00e9curit\u00e9 permet d’informer les employ\u00e9s sur les cybermenaces et sur le r\u00f4le qu’ils jouent dans le maintien de la s\u00e9curit\u00e9. Le facteur humain est souvent le maillon faible de la cybers\u00e9curit\u00e9, et des employ\u00e9s bien inform\u00e9s peuvent renforcer consid\u00e9rablement vos d\u00e9fenses.<\/span><\/li>\n<\/ol>\n
            Conclusions<\/h2>\n
            Une d\u00e9tection efficace de la force brute est cruciale dans le paysage num\u00e9rique actuel, et notre script PowerShell offre une solution puissante et personnalisable. Cependant, il est essentiel de se rappeler qu’il fait partie d’une strat\u00e9gie de cybers\u00e9curit\u00e9 plus large. En associant la d\u00e9tection en temps r\u00e9el \u00e0 des mots de passe forts, \u00e0 l’AMF, \u00e0 des mises \u00e0 jour logicielles et \u00e0 la formation des employ\u00e9s, vous pouvez cr\u00e9er un protocole de s\u00e9curit\u00e9 complet pour prot\u00e9ger vos actifs num\u00e9riques.<\/span>\u00a0<\/span><\/p>\n
            NinjaOne est un outil complet qui renforce consid\u00e9rablement votre capacit\u00e9 \u00e0 d\u00e9tecter et \u00e0 contrer les attaques par force brute. Avec un <\/span>un contr\u00f4le total sur la s\u00e9curit\u00e9 des terminaux<\/span><\/a> vous pouvez g\u00e9rer les applications, modifier les registres \u00e0 distance et d\u00e9ployer des scripts pour renforcer la s\u00e9curit\u00e9. Les contr\u00f4les d’acc\u00e8s bas\u00e9s sur les r\u00f4les garantissent que vos techniciens n’ont que les niveaux d’acc\u00e8s n\u00e9cessaires, r\u00e9duisant ainsi les points d’intrusion potentiels. La plateforme offre \u00e9galement des outils de gestion du cryptage des lecteurs et la possibilit\u00e9 d’installer et de g\u00e9rer automatiquement la protection des terminaux, ce qui permet un contr\u00f4le pr\u00e9cis des op\u00e9rations antivirus.<\/span>\u00a0<\/span><\/p>\n
            De plus, <\/span>la fonction d’\u00e9change d’informations d’identification de NinjaOne prot\u00e8ge les informations d’identification<\/span><\/a>, et constitue une ligne de d\u00e9fense cruciale contre les attaques par force brute. Il permet \u00e9galement d’identifier et de supprimer les terminaux malveillants, ce qui ajoute une couche de protection suppl\u00e9mentaire. N’attendez pas qu’une intrusion se produise. <\/span>Commencez d\u00e8s aujourd’hui votre p\u00e9riple vers une s\u00e9curit\u00e9 renforc\u00e9e<\/span><\/a> d\u00e8s maintenant avec NinjaOne.<\/span>\u00a0<\/span><\/p>\n","protected":false},"author":35,"featured_media":206798,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","_lmt_disableupdate":"no","_lmt_disable":""},"operating_system":[4212],"use_cases":[4281],"class_list":["post-208349","script_hub","type-script_hub","status-publish","has-post-thumbnail","hentry","script_hub_category-windows"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/script_hub\/208349","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/script_hub"}],"about":[{"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/types\/script_hub"}],"author":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/comments?post=208349"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/media\/206798"}],"wp:attachment":[{"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/media?parent=208349"}],"wp:term":[{"taxonomy":"script_hub_category","embeddable":true,"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/operating_system?post=208349"},{"taxonomy":"use_cases","embeddable":true,"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/use_cases?post=208349"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}