SSH authentication brute force attempts

Cortex XDR Analytics Alert Reference by data source

Product
Cortex XDR
Last date published
2024-12-03
Category
Analytics Alert Reference
Order
data source

Synopsis

Activation Period

14 Days

Training Period

30 Days

Test Period

15 Minutes

Deduplication Period

3 Hours

Required Data

  • Requires:
    • XDR Agent

Detection Modules

Identity Analytics

Detector Tags

ATT&CK Tactic

Credential Access (TA0006)

ATT&CK Technique

Brute Force (T1110)

Severity

Informational

Description

A user attempted to authenticate via SSH an excessive number of times in a short period. This may indicate a brute force attack.

Attacker's Goals

Attackers attempt to log in to a remote host.

Investigative actions

Verify any successful authentication by the user account referenced by the alert, as these can indicate the attacker managed to guess the credentials.

Variations

Successful SSH Brute Force

Synopsis

ATT&CK Tactic

Credential Access (TA0006)

ATT&CK Technique

Brute Force (T1110)

Severity

Low

Description

A user successfully authenticated via SSH after an excessive number of failures in a short period.

Attacker's Goals

Attackers attempt to log in to a remote host.

Investigative actions

Verify any successful authentication by the user account referenced by the alert, as these can indicate the attacker managed to guess the credentials.


Possible SSH Brute Force

Synopsis

ATT&CK Tactic

Credential Access (TA0006)

ATT&CK Technique

Brute Force (T1110)

Severity

Low

Description

A user attempted to authenticate via SSH an excessive number of times in a short period. This may indicate a brute force attack.

Attacker's Goals

Attackers attempt to log in to a remote host.

Investigative actions

Verify any successful authentication by the user account referenced by the alert, as these can indicate the attacker managed to guess the credentials.