Potential SSH Brute Force Detected on Privileged Account

## Triage and analysis

### Investigating Potential SSH Brute Force Attack on Privileged Account

The rule identifies consecutive SSH login failures targeting a privileged (root) account from the same source IP
address to the same target host indicating brute force login attempts.

#### Possible investigation steps

- Investigate the login failure on privileged account(s).
- Investigate the source IP address of the failed ssh login attempt(s).
- Investigate other alerts associated with the user/host during the past 48 hours.
- Identify the source and the target computer and their roles in the IT environment.

### False positive analysis
- Authentication misconfiguration or obsolete credentials.
- Service account password expired.
- Infrastructure or availability issue.

### Response and remediation
- Initiate the incident response process based on the outcome of the triage.
- Isolate the involved hosts to prevent further post-compromise behavior.
- Investigate credential exposure on systems compromised or used by the attacker to ensure all compromised accounts are
identified.
- Reset passwords for these accounts and other potentially compromised credentials.
- Run a full antimalware scan. This may reveal additional artifacts left in the system, persistence mechanisms, and
malware components.
- Determine the initial vector abused by the attacker and take action to prevent reinfection through the same vector.
- Using the incident response data, update logging and audit policies to improve the mean time to detect (MTTD) and the
mean time to respond (MTTR).