SSH - Potential Brute Force

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Content Index


'Identifies an IP address that had 15 failed attempts to sign in via SSH in a 4 hour block during a 24 hour time period. Please note that entity mapping for arrays is not supported, so when there is a single value in an array, we will pull that value from the array as a single string to populate the entity to support entity mapping features within Sentinel. Additionally, if the array is multivalued, we will input a string to indicate this with a unique hash so that matching will not occur. As

Attribute Value
Type Analytic Rule
Solution Syslog
ID e1ce0eab-10d1-4aae-863f-9a383345ba88
Severity Low
Kind Scheduled
Tactics CredentialAccess
Techniques T1110
Required Connectors Syslog, SyslogAma
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Selection Criteria Transformations Ingestion API Lake-Only
Syslog ProcessName == "sshd"
SyslogMessage contains "Failed password for invalid user"
?

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊

Back to Analytic Rules · Back to Syslog