Brute-force attempts
HighDetect repeated failed login attempts and password spraying activity.
Threat detection: Spot the unusual. Understand the risk. Act with context.
Identify suspicious activity, enrich events with threat intelligence and focus your investigation where it matters.
Behavioral analysis
Know when
normal changes.
Detect unusual activity patterns that may indicate a security threat, from login behavior to file access and privilege use.
Unusual login frequency
Identify spikes in login attempts and abnormal user behavior.
Unexpected source locations
Spot access from unusual locations or unfamiliar IP addresses.
Unusual file access and privilege activity
Detect suspicious file access, privilege changes and sensitive system activity.
Threat intelligence
Add intelligence
to every investigation.
Match log indicators with threat intelligence to understand the bigger picture. Enrich events with reputation data and known malicious indicators so your team can investigate faster and with more confidence.
- Malicious IP indicators
- Botnet activity
- TOR exit nodes
- Brute-force sources
ThreatPeak integration for enriched threat data.
ThreatPeak integration
ThreatPeak integration: threat intelligence in every event
Logchase integrates with ThreatPeak to bring threat intelligence into your log data. Instead of checking suspicious addresses one by one in a separate threat intelligence platform, analysts see the reputation of an indicator in the same view as the event.
How enrichment works
As logs are ingested, Logchase checks source and destination IP addresses against the threat list and marks matches on the event itself. Ready-made correlation rules then alert on inbound and outbound traffic involving malicious addresses, on repeated communication and on two-way traffic, and reports can be filtered to flagged events. The indicator list refreshes automatically in the background, so new indicators apply to incoming logs without manual updates.
For the bigger picture, read Threat intelligence platforms: how enrichment speeds up investigations.
Indicators matched against your logs
Malicious IPs
Addresses associated with attacks, scanning and abuse.
Botnet activity
Hosts tied to botnets and their command-and-control (C2) traffic.
TOR exit nodes
Connections that arrive through the TOR network, which hides the real origin.
Brute-force sources
Addresses seen guessing passwords against other systems.
Matched indicators also feed into the risk score, so your team looks at the riskiest events first.
Event investigation
Follow the signs.
See the sequence.
Suspicious activity becomes clearer when related events are viewed together. See the full sequence from initial access to further activity to understand the context and take the right action.
Threat scenarios
Detect the behaviors that matter.
Identify suspicious activities across your environment, from initial access to lateral movement.
Webshell uploads
MediumIdentify suspicious file uploads and webshell deployments.
Privilege escalation
HighDetect unexpected privilege changes and suspicious account modifications.
Suspicious processes
MediumIdentify abnormal process execution and living-off-the-land techniques.
Lateral movement
MediumDetect unusual access to multiple systems and suspicious internal movement.
Detection in detail
How Logchase detects common attack behaviors
Each behavior below maps to techniques in the MITRE ATT&CK framework. Logchase rule templates carry the matching technique IDs, which makes alerts easier to triage, report on and connect to your threat detection and response process.
Brute-force attacks
In a brute-force attack, an attacker tries many passwords against one account, or one common password against many accounts (password spraying), until something works. SSH, RDP, VPN gateways and web login pages are the usual targets. The real danger is the success at the end: a valid login after a run of failures often means an account has been taken over.
How Logchase detects it: by default, a ready-made rule alerts when five or more failed logins arrive within five minutes, and a separate critical rule flags a successful login that follows repeated failures. Source addresses are also checked against the brute-force sources from ThreatPeak.
Webshell uploads
A webshell is a small script, usually PHP, ASPX or JSP, placed on a web server so an attacker can run commands through ordinary HTTP requests. It typically arrives through a vulnerable upload form, plugin or unpatched application, then serves as a quiet backdoor that blends into normal web traffic.
How Logchase detects it: file integrity monitoring flags new or modified script files in web directories such as /var/www/html, while web security rules catch the exploit and command injection attempts that often deliver them. Correlating both shows the request and the file together.
Privilege escalation
Privilege escalation turns a foothold into control. A normal user or service account gains administrator or root rights by exploiting a vulnerability, abusing a misconfiguration or being added to a privileged group. It is often the step right before data access, defense evasion or lateral movement.
How Logchase detects it: behavioral analysis highlights privilege changes that break an account's normal pattern, FIM records edits to files such as /etc/sudoers, and exploit rules alert on exploitation attempts reported by IDS/IPS devices. Risk scoring moves these events to the top of the queue.
Suspicious processes
Attackers prefer tools that are already on the system: PowerShell, cmd.exe, scripting engines and admin utilities. These living-off-the-land techniques avoid dropping obvious malware, so the signal is in how a process starts rather than what it is, such as an Office document spawning PowerShell or a tool reading LSASS memory to steal credentials.
How Logchase detects it: template rules alert when Word, Excel, Outlook or PowerPoint start PowerShell or cmd.exe, and on LSASS memory dumps and other credential theft techniques. Process events from your endpoints are searchable and correlated like any other log.
Lateral movement
Lateral movement is an attacker moving from one compromised system to others in the same network, typically over RDP, SMB, SSH or remote management tools and with stolen credentials. Each hop looks like a normal login on its own; the pattern only appears when events from different hosts are put in order.
How Logchase detects it: a correlation rule alerts when one internal host connects to many other internal hosts in a short window, and the investigation timeline puts login and process events from different sources in sequence so you can follow the path.
Risk scoring
Prioritize with a clearer risk picture.
Each event can be assigned a risk score based on behavior, threat intelligence and contextual information. This helps your team prioritize investigation and focus on the most important threats.
0 – 49
LowInformational events
50 – 84
HighSuspicious activity patterns
85 – 100
CriticalActive attack indicators
Detection and response
From threat detection to response
Threat detection only pays off when alerts turn into action. Logchase keeps the path from alert to resolution in one place.
Alerts with context
Each alert keeps the log events that triggered it, together with the rule and its severity, so analysts can go back to the raw data while they investigate.
Recommended next steps
Ready-made rule templates come with a recommended action, such as blocking a source IP or isolating a host, so the first response is not improvised.
Status and notes
Alerts move from open to investigating to resolved or closed. Notes and the person who resolved an alert are recorded, so handovers between analysts stay clear.
Email notifications
Alert notifications can be emailed to the addresses you choose, so the right people hear about them outside the console.
Need something specific? Build your own rules with field conditions, regular expressions, thresholds, time windows and business-hours checks in Logchase SIEM.
FAQ
Frequently asked questions
Common questions about threat detection and threat intelligence in Logchase.
How does Logchase detect threats?
It learns normal behavior for login frequency, source location, file access and privilege use, then flags activity that deviates from it as well as known attack patterns.
What does threat intelligence enrichment do?
Indicators in your logs, such as IP addresses, are matched against known malicious IPs, botnet activity, TOR exit nodes and brute-force sources (ThreatPeak integration), so analysts see the risk in the same view. Read more in Threat intelligence platforms: how enrichment speeds up investigations.
What is a risk score?
A risk score combines severity, related event count and reputation data so your team can work on the riskiest events first.
Which attack behaviors can it detect?
Brute-force attempts, webshell uploads, privilege escalation, suspicious process execution and lateral movement.
What is lateral movement and how is it detected?
Lateral movement is an attacker moving from one compromised system to others. Logchase correlates login and process events across sources in sequence to make it visible.
Ready to detect threats