Default SSH Credential Attempt - Root Login

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects multiple failed SSH login attempts using the username 'root' to a server on the home network. It triggers an alert if five such attempts occur within a 30-second window from the same source IP address. This behavior often indicates a brute-force attack targeting default credentials.