# Comprehensive SSH Security Rules
# Author: Security Team
# Date: 2025-11-11
# Purpose: Detect various SSH attack patterns and anomalies
# Rule 1: Enhanced SSH Brute Force Detection
alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (
msg:"SSH brute-force attempt from external source";
flow:to_server;
content:"SSH-"; depth:4;
detection_filter:track by_src,count 5,seconds 60;
classtype:attempted-recon;
reference:cve,2019-6109;
sid:2220001; rev:3; priority:2;
)
# Note: Detects 5+ SSH connections from external sources within 60 seconds
# Focuses on external threats, uses protocol verification
# Rule 2: Internal SSH Brute Force
alert tcp $HOME_NET any -> $HOME_NET 22 (
msg:"SSH brute-force attempt from internal source";
flow:to_server;
content:"SSH-"; depth:4;
detection_filter:track by_src,count 8,seconds 120;
classtype:attempted-recon;
sid:2220002; rev:1; priority:3;
)
# Note: Higher threshold for internal sources (8 attempts in 2 minutes)
# Accounts for legitimate internal automation while catching lateral movement
# Rule 3: SSH Version Scanning
alert tcp any any -> $HOME_NET 22 (
msg:"SSH version enumeration attempt";
flow:to_server,established;
content:"SSH-"; depth:4;
pcre:"/SSH-[0-9]\.[0-9]/";
flowbits:set,[Link];
threshold:type both,track by_src,count 10,seconds 300;
classtype:attempted-recon;
sid:2220003; rev:1; priority:3;
)
# Note: Detects rapid SSH version checks from single source
# Sets flowbit for correlation with other SSH activities
# Rule 4: SSH Authentication Failure Pattern
alert tcp any any -> $HOME_NET 22 (
msg:"SSH repeated authentication failures";
flow:to_server,established;
content:"Authentication failed"; nocase;
detection_filter:track by_src,count 3,seconds 30;
classtype:unsuccessful-user;
sid:2220004; rev:1; priority:2;
)
# Note: Monitors SSH daemon logs for auth failures (requires log inspection)
# Lower threshold due to specific failure detection
# Rule 5: SSH Tunneling Detection
alert tcp $HOME_NET any -> any any (
msg:"Potential SSH tunnel - high data volume";
flow:from_server,established;
flowbits:isset,[Link];
byte_test:4,>,1000000,0;
threshold:type limit,track by_src,count 1,seconds 300;
classtype:policy-violation;
sid:2220005; rev:1; priority:3;
)
# Note: Detects large data transfers over established SSH connections
# May indicate data exfiltration or unauthorized tunneling
# Rule 6: SSH Connection to Unusual Ports
alert tcp any any -> $HOME_NET !22 (
msg:"SSH connection to non-standard port";
flow:to_server;
content:"SSH-"; depth:4;
classtype:policy-violation;
sid:2220006; rev:1; priority:3;
)
# Note: Identifies SSH services running on non-standard ports
# Helps detect SSH services that may bypass security controls
# Rule 7: Weak SSH Cipher Detection
alert tcp any any -> $HOME_NET 22 (
msg:"SSH weak cipher negotiation detected";
flow:to_server,established;
content:"diffie-hellman-group1-sha1"; nocase;
classtype:policy-violation;
reference:url,[Link]/rfc/[Link];
sid:2220007; rev:1; priority:2;
)
# Note: Detects use of deprecated/weak SSH ciphers
# Helps enforce strong cryptographic standards
# Rule 8: SSH Key Exchange Anomaly
alert tcp any any -> $HOME_NET 22 (
msg:"SSH key exchange anomaly - potential downgrade attack";
flow:to_server,established;
content:"SSH-1."; depth:6;
classtype:attempted-admin;
reference:cve,2016-0777;
sid:2220008; rev:1; priority:1;
)
# Note: Detects SSH protocol version 1.x which has known vulnerabilities
# High priority due to potential security bypass
# Rule 9: SSH Connection Flood
alert tcp any any -> $HOME_NET 22 (
msg:"SSH connection flood detected";
flags:S;
threshold:type both,track by_dst,count 50,seconds 60;
classtype:attempted-dos;
sid:2220009; rev:1; priority:2;
)
# Note: Detects SYN flood targeting SSH service
# Tracks by destination to identify targeted attacks
# Rule 10: SSH Successful Login After Brute Force
alert tcp any any -> $HOME_NET 22 (
msg:"SSH successful login after brute force attempt";
flow:to_server,established;
flowbits:isset,[Link];
content:"Authentication succeeded"; nocase;
classtype:successful-admin;
sid:2220010; rev:1; priority:1;
)
# Note: Correlates successful login with previous scanning activity
# High priority as it may indicate successful compromise
# Rule 11: SSH Root Login Attempt
alert tcp any any -> $HOME_NET 22 (
msg:"SSH root login attempt detected";
flow:to_server,established;
content:"root"; nocase;
content:"login"; distance:0; within:20; nocase;
classtype:attempted-admin;
sid:2220011; rev:1; priority:2;
)
# Note: Detects direct root login attempts via SSH
# Should be disabled in secure environments
# Rule 12: SSH Session Duration Anomaly
alert tcp $HOME_NET 22 -> any any (
msg:"SSH session unusually long duration";
flow:from_server,established;
flowbits:set,[Link];
threshold:type limit,track by_src,count 1,seconds 14400;
classtype:policy-violation;
sid:2220012; rev:1; priority:3;
)
# Note: Flags SSH sessions lasting over 4 hours
# May indicate persistent access or data exfiltration
# Supplementary Rules for IPv6 Support
alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (
msg:"SSH brute-force attempt from external IPv6 source";
flow:to_server;
content:"SSH-"; depth:4;
detection_filter:track by_src,count 5,seconds 60;
classtype:attempted-recon;
sid:2220013; rev:1; priority:2;
)
# Note: IPv6 version of primary brute force rule
# Ensures coverage across both IP versions