Python-scripted credential brute-force: ssh_brute/brute3/auto_login with pw.txt

Arnold Chan@slaz

•updated 3 days ago•3•0•3

Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.