Brutforce on Windows OpenSSH server with valid users

title: Brutforce on Windows OpenSSH server with valid users
name: bruteforce_openssh_vaild_users
description: Detects scenarios where an attacker attempts to SSH brutforce a Windows OpenSSH server with a valid user.
remarks: This requires to have previously enabled the builtin OpenSSH server or to have installed the "OpenSSH-Win64" component. IpAddress or Workstation fields may be empty. In case Workstation field is not empty, be aware that it may wrongly report the source host. Also note that SSH logins are reported with logon type 8 (clear text). For reliable source IP information, use the logs from the OpenSSH channel, event ID 4.
references:
  - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0006-Credential%20Access/T1110.xxx-Brut%20force
  - https://winaero.com/enable-openssh-server-windows-10/
  - https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
  - https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx
tags:
  - attack.credential_access
  - attack.t1110
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4625
    SubStatus: "0xc000006A" # invalid password | Failure code can be defined in "Status" or "Substatus" fields. Usually, if Substatus == 0x0, refers to Status.
    ProcessName|endswith: # Can be "C:\Program Files\OpenSSH-Win64\sshd.exe" or "C:\Windows\system32\OpenSSH\sshd.exe"
      - '\sshd.exe'
      - '\ssh.exe'
  condition: selection
falsepositives:
  - None
level: high

---
title: Brutforce on Windows OpenSSH server with valid users Count
status: experimental
correlation:
  type: value_count
  rules:
    - bruteforce_openssh_vaild_users # Referenced here
  group-by:
    - Computer
  timespan: 30m
  condition:
    gte: 20
    field: EventRecordID
level: high