Linux SSH Brute Force with Successful Login
This rule detects a potential brute-force attack followed by a successful login attempt against a Linux host. It specifically looks for a user account that experiences at least 10 failed password attempts within a 10-minute window, immediately followed by at least one successful password attempt for the same user on the same host within that same 10-minute window. The rule extracts the user, source IP, and port for both failed and successful attempts.
Splunk (SPL)
