Brute force repeated failures
Detects repeated SSH authentication failures from a single source IP against one user within a short window.
What it detects
Detects repeated SSH authentication failures from a single source IP against one user within a short window. A high-confidence indicator of SSH brute-force or password spraying.
MITRE ATT&CK mapping
- T1110Brute Force· Credential Access
False positives and triage
Legitimate load balancers or monitoring systems may cause clustered failures. Tune the threshold or allowlist known infrastructure before confirming an incident.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 90%. Source: rules/linux/ssh_brute_force_repeated_failures.yaml, licensed under the Apache License 2.0.
id: linux.ssh.brute_force_repeated_failures
version: 1.0.0
status: stable
severity: high
confidence: 0.9
platforms: [linux]
mitre_techniques: [T1110]
description: |
Detects repeated SSH authentication failures from a single source IP against one user
within a short window. A high-confidence indicator of SSH brute-force or password spraying.
match:
event_category: authentication
event_outcome: failure
provider: sshd
threshold:
count: 5
window_seconds: 600
group_by: [source_ip, user_name]
correlation_keys: [source_ip:user_name]
false_positive_guidance: |
Legitimate load balancers or monitoring systems may cause clustered failures. Tune the
threshold or allowlist known infrastructure before confirming an incident.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.