LeakySensey: SSH brute-force pattern: repeated failed logons then success

Arnold Chan@slaz

•updated Sep 17, 2026•0•0•0

Detects anomalous SSH authentication patterns characterized by a high volume of failed logon attempts (>= 10) originating from a specific IP address within a short timeframe (30 minutes), followed by a successful authentication to the same target device. This pattern is indicative of a successful credential brute-force or password guessing attack against an exposed SSH service.