SSH Brute Force detection

id: '5453.5608'
title: SSH Brute Force detection
description: 'Detect possible brute force attempts using SSH in Unix. - Threat Actor
  Association: 8220 Gang, Daixin Team, Lancefly, Sandworm (UAC-0165)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_unix` TERM(ssh) TERM(res=failed) TERM(type=USER_AUTH)
  | rex field=_raw "[^\w]"(?<process_name>"(ssh)")"[^\w]"| eval src_ip=mvfilter( NOT
  match(addr,"\?")), user=mvappend("",acct,user,auid,uid), user=mvfilter(NOT match(user,"\?|\(unknown\)|\d+|unset|^\s$|^$")),
  user_id=mvappend("",auid,uid), user_id=mvfilter(match(user_id,"\d+")) | table _time,
  host, user process, process_*, res, src_ip, user_id | bin _time span=10sec | eventstats
  count by host, _time, res | stats values(*) as * by host, _time, res | where count
  > 3 | bin _time span=10min | stats values(*) as * list(count) as count_list sum(count)
  as count_span by host, _time, res | where mvcount(count_list) > 1 OR count_span
  > 20 | rename count_span as count| lookup dnslookup clientip as src_ip OUTPUT clienthost
  as src_dns | iplocation prefix="src_" src_ip | rename src_Country as src_country '
techniques:
- credential-access:brute force:password guessing
- credential-access:brute force:password spraying
technique_id:
- T1110.001
- T1110.003
data_category:
- Process command-line parameters
- Linux audit logs
references:
- https://linuxhint.com/bruteforce_ssh_ftp/