<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting Ransomware Initial Access Vectors — API Reference

## Authentication Log Analysis

| Log Source | Location | Key Fields |
|-----------|----------|------------|
| Linux auth | `/var/log/auth.log` | timestamp, user, source_ip, status |
| Windows Security | Event ID 4625 | TargetUserName, IpAddress, LogonType |
| VPN logs | Vendor-specific | user, source_ip, geo, mfa_status |
| Exchange IIS | `W3SVC1/u_ex*.log` | cs-uri-stem, cs-uri-query, c-ip |

## Fail2ban Configuration

```ini
[sshd-aggressive]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
findtime = 300
bantime = 86400

[vpn-bruteforce]
enabled = true
port = 443
filter = vpn-auth
logpath = /var/log/vpn/auth.log
maxretry = 5
findtime = 600
bantime = 43200
```

## KQL Queries — Initial Access

```kql
// Brute-force detection across identity providers
SigninLogs
| where ResultType != "0"
| summarize FailCount=count() by UserPrincipalName, IPAddress, bin(TimeGenerated, 5m)
| where FailCount > 10

// Impossible travel detection
SigninLogs
| where ResultType == "0"
| summarize Locations=make_set(Location) by UserPrincipalName, bin(TimeGenerated, 1h)
| where array_length(Locations) > 1
```

## nmap Service Discovery

```bash
# Quick external surface scan
nmap -sV -sC -p 21,22,80,443,445,3389,8443 <TARGET> -oX scan.xml

# Check for specific vulnerable services
nmap --script http-vuln* -p 443 <TARGET>

# Detect RDP with NLA status
nmap -p 3389 --script rdp-ntlm-info <TARGET>
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `log_path` | Auth log file path | `/var/log/auth.log` |
| `threshold` | Failure count before alert | `10` |
| `target` | IP to scan for exposed services | `203.0.113.50` |
| `findtime` | Brute-force detection window | `300` (seconds) |
