SSH Brute Force Attempt Detected

Darshan Thummar@Mighty

•updated Jun 5, 2026•0•0•6

Detects repeated failed SSH authentication attempts which may indicate brute force activity against SSH services. The rule specifically looks for 8 SSH connection attempts to port 22 within a 60-second window from the same source IP.