ATT&CK T1110.001 - SSH Password Brute Force

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects a potential SSH password brute force attack. It triggers an alert if there are 30 or more TCP connections to port 22 (SSH) on the home network from a single source IP address within a 60-second window. The 'flow:to_server' and 'flags:S' indicate that it's looking for new connection attempts (SYN packets) directed towards the server.