Anomalous failed SSH authentication attempts by a single IP address

문서 > Datadog 보안 > OOTB Rules > Anomalous failed SSH authentication attempts by a single IP address

Classification:

anomaly

Tactic:

TA0006-credential-access

Technique:

T1110-brute-force

Set up the zeek integration.

이 페이지는 아직 영어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우 언제든지 연락주시기 바랍니다.

Goal

Detect when an anomalous number of failed SSH authentication attempts have been made by a single IP address.

Strategy

This rule monitors Zeek SSH logs for when there has been an anomalous number of failed SSH authentication attempts by a single IP address. Attackers may try to brute force access to a server to gain direct or lateral access to a victim’s environment.

Triage and response

Verify whether the client IP {{@network.client.ip}} is internal or external.
For internal IPs, identify the corresponding host and collaborate with the owner to investigate any host-based alerts, addressing potential compromises.
For external IPs, assess the IP address reputation, specifically looking for associations with SSH-based attacks, and determine if the destination host should be accessible via external IPs over SSH.