📎 AI Summary:
The original poster is investigating whether Windows logs can reveal details about an attacking machine, such as hostname or user information, during a brute-force Windows 10 hacking attempt using Kali Linux. The response clarifies that Windows Event Logs typically only show the attacker's IP address unless DNS entries are present and that OS details aren't transmitted during such attacks. It suggests using tools like nmap for active detection and scanning of the attacker’s machine. The overall tone is technical and inquisitive, focusing on security forensics.
C

Cmann

New Member
Member details
Joined
Jan 26, 2020
Messages
14
Thread Author #1
I am currently in the middle of testing a hack on a Windows 10 virtual machine via brute force attack. I successfully hacked into the Windows 10 (victim) machine via OpenSSH port which I opened myself
I have looked on Windows Event viewer and have noticed that it shows the attack attempts and when it has succeeded.
The event log shows information of the attack with the Event ID and it’s impersonation level.
Is there anywhere in Windows where I can see information about the attacking machine? The attacking machine I used was Kali Linux.
I’m wanting to know if I can pick up information of the attacking machine within Windows such as the name of the user attacking the machine, the type of machine or the host name? All I seem to receiving in the Event Logs is only the IP address of the attacker.
Thanks
 

Solution
Neemobeer
The hostname would rely on DNS, so unless the attacker has added an entry to DNS you're resolving from then no. And no you wouldn't be able to ID the attacking OS since that type of info isn't transmitted. You could detect and then actively scan it with a tool like nmap
Sort by date Sort by votes
Neemobeer

Neemobeer

Windows Forum Team
Staff member
Member details
Joined
Jul 4, 2015
Messages
8,995
#2
The hostname would rely on DNS, so unless the attacker has added an entry to DNS you're resolving from then no. And no you wouldn't be able to ID the attacking OS since that type of info isn't transmitted. You could detect and then actively scan it with a tool like nmap
 

Upvote 1 Downvote
Solution
You must log in or register to reply here.