SSH brute-force burst against exposed Linux/IoT device

Ethan Andrews@eandrews

•updated Aug 17, 2026•3•0•6

This rule detects successful SSH logins that follow a burst of at least 10 failed SSH authentication attempts from the same remote IP address to the same device within a 10-minute window, followed by a successful login within 15 minutes. This pattern is indicative of a successful credential brute-force attack, frequently associated with botnet propagation efforts.