Failed SSH logins using administrative accounts
This rule detects when a user containing the name "admin" in the username fails to log in via SSH. This could indicate an attempt to access the system using administrative credentials, which may be a sign of malicious activity. However, it is important to note that this rule may also generate false positives if legitimate users with "admin" in their usernames fail to log in due to typos or other issues.
Sigma
