SSH Brute Force

Detects a burst of "Failed password" authentication events from sshd against the same source IP within a short window - password spraying or brute forcing against an exposed SSH service.

T1110 T1021.004

Detection logic

{
  "detection_type": "threshold",
  "selection": {
    "process": "sshd",
    "action": "auth_fail"
  },
  "groupby": "src_ip",
  "timeframe_minutes": 5,
  "threshold": 10,
  "condition": "gte"
}

Log source: product=linux, service=sshd · Event ID(s): sshd_auth_fail

Required log fields

src_ip
user
port

Enabling this in your environment

Where: /etc/ssh/sshd_config

Set "LogLevel VERBOSE" in /etc/ssh/sshd_config and reload sshd (systemctl reload sshd) so failed/accepted attempts include the source IP and, on success, the key fingerprint used.

Default rsyslog/journald config already forwards sshd auth lines to /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/CentOS) - confirm your log shipper (Filebeat/Fluentd/etc.) is actually tailing that file and parsing src_ip/user out of the free-text sshd message, since sshd does not emit structured fields natively.

False positives

Misconfigured automation/monitoring retrying with stale credentials
Shared NAT egress serving many legitimate users

References

https://attack.mitre.org/techniques/T1110/