SSH Brute-Force with Sequential/Enumerated Usernames (Firewall Log)

Ankit Mehta@Secvyn

•updated 22 days ago•0•0•4

Detects repeated SSH authentication failures originating from an external source on port 22, where the username pattern appears to be programmatically generated or enumerated (e.g., username followed by digits). This behavior is characteristic of automated brute-force attempts targeting common SSH services.