ATT&CK T1078 - SSH Brute Force Detected

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•2

This rule detects an SSH brute force attack by monitoring TCP connections to port 22 (SSH) on the home network. It triggers an alert if more than 20 TCP SYN packets are observed from a single source IP address within a 60-second window, indicating a high volume of connection attempts characteristic of a brute force.