Burst of failed SSH logins followed by a success from one source

Threat behaviour covered

Password guessing against SSH produces many failures from one address before a guess succeeds. The query counts failed and accepted password logins per source in a short window and flags sources with both.

Detection logic

index=linux sourcetype=linux_secure ("Failed password" OR "Accepted password")
| rex "(?<outcome>Failed|Accepted) password for (invalid user )?(?<user>\S+) from (?<src>\S+)"
| bin _time span=15m
| stats count(eval(outcome="Failed")) AS failures
        count(eval(outcome="Accepted")) AS successes
        dc(user) AS accounts
        BY _time, src
| where failures >= 10 AND successes >= 1
| sort - failures

Data sources

• Linux authentication logs (/var/log/auth.log or /var/log/secure) ingested as linux_secure, with the SSH daemon logging at the default level

False positives and tuning

• Users who mistype a password many times, and automation with a stale credential.
• Shared NAT or bastion hosts that aggregate many users behind one address.
• Raise or lower the failure threshold and the window to suit your environment.

Limitations

• Only password authentication is covered; key-based logins and keyboard-interactive methods are logged differently. A slow, low-volume spray stays under the threshold, so also review failures per account over longer windows. Field extraction depends on your log format.