README…

It's basically a fail2ban for windows. Its goals are also mainly what we love about fail2ban:

pre-configured no-initial-ducking-around-with-scripts-or-config-files install-and-forget You can download it here ( v2.1.5 - April 2022 ) .

Also, we love issues!

If anyone needs something or has questions about something, please feel free to open an issue. We are especially happy to get issues about log-entry samples we don't react on, or ideas of how we can support more protocols.

A bit more detailed description of what EvlWatcher does.

Scenario: there are those bad people out there, hammering your service (RDP and whatnot) with brute force attempts.

You can see them and their IPs clearly in the Windows Event-Log.

You have searched the web and yea, there are plenty of tools, scripts, and all that, to read the event-log and automatically ban the attackers IP.

You however, are lazy. You need something like fail2ban, with a preconfigured set of rules to just RUN right away and it works.

But then, it still needs enough flexibility for you to completely configure it, should you wish to do so. EvlWatcher does that. It scans the Windows-Event-Log, and reacts.

It works by installing a service that scans the event log for unsuccessful login attempts. When one of its rules are violated (e.g. trying to log in without correct credentials, more than 5 times in 2 minutes), it will place that poor bastard into a generic firewall rule, and thereby ban the attacker for 2 hours.

Also, when someone is repeatedly trying, there is a permanent ban list for that, where people defaultly land on when they've had three strikes.

You can, of course, adjust the rules to your liking. They are basically a consisting of an event source, and a Regex to extract an IP, its pretty simple.