Logon success
A successful SSH logon ("Accepted password/publickey").
What it detects
A successful SSH logon ("Accepted password/publickey"). Routine and low-signal on its own — surfaced so the correlation engine can pair it with a preceding SSH brute-force burst from the same source address and account, which together indicate a brute force that likely SUCCEEDED. Never an incident by itself.
MITRE ATT&CK mapping
- T1078Valid Accounts· Defense Evasion
False positives and triage
Most successful SSH logons are legitimate; this rule is deliberately low severity and confidence. It becomes noteworthy only when it directly follows an SSH brute-force burst against the same account from the same source IP.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 10%. Source: rules/linux/logon_success.yaml, licensed under the Apache License 2.0.
id: linux.ssh.logon_success
version: 1.1.0
status: stable
severity: low
confidence: 0.1
platforms: [linux]
role: context
mitre_techniques: [T1078]
description: |
A successful SSH logon ("Accepted password/publickey"). Routine and low-signal
on its own — surfaced so the correlation engine can pair it with a preceding SSH
brute-force burst from the same source address and account, which together
indicate a brute force that likely SUCCEEDED. Never an incident by itself.
match:
event_category: authentication
event_action: login_success
event_outcome: success
provider: sshd
correlation_keys: [source_ip:user_name]
false_positive_guidance: |
Most successful SSH logons are legitimate; this rule is deliberately low
severity and confidence. It becomes noteworthy only when it directly follows an
SSH brute-force burst against the same account from the same source IP.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.