Anomalous failed SSH authentication attempts by a single IP address

Docs > Plateforme de sécurité Datadog > OOTB Rules > Anomalous failed SSH authentication attempts by a single IP address

This rule is part of a beta feature. To learn more, contact Support.

Classification:

anomaly

Tactic:

TA0006-credential-access

Technique:

T1110-brute-force

Set up the zeek integration.

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Goal

Detect when an anomalous number of failed SSH authentication attempts have been made by a single IP address.

Strategy

This rule monitors Zeek SSH logs for when there has been an anomalous number of failed SSH authentication attempts by a single IP address. Attackers may try to brute force access to a server to gain direct or lateral access to a victim’s environment.

Triage and response

Verify whether the client IP {{@network.client.ip}} is internal or external.
For internal IPs, identify the corresponding host and collaborate with the owner to investigate any host-based alerts, addressing potential compromises.
For external IPs, assess the IP address reputation, specifically looking for associations with SSH-based attacks, and determine if the destination host should be accessible via external IPs over SSH.