Browse Rules

Search and filter across all detection sources

420 rules

wazuh low xml

sshd: Corrupted bytes on SSHD.

sshd: Corrupted bytes on SSHD.

wazuh informational xml

sshd: System disconnected from sshd.

sshd: System disconnected from sshd.

wazuh informational xml

sshd: Useless/Duplicated SSHD message without a user/ip.

sshd: Useless/Duplicated SSHD message without a user/ip.

sagan low other

sshd detected

sshd detected

wazuh informational xml

sshd: Useless SSHD message without an user/ip and context.

sshd: Useless SSHD message without an user/ip and context.

wazuh informational xml

sshd: sshd could not load one or more host keys.

sshd: sshd could not load one or more host keys.

wazuh informational xml

SSHD messages grouped.

SSHD messages grouped.

wazuh informational xml

sshd: Debug message.

sshd: Debug message.

wazuh low xml

sshd: connection refused

sshd: connection refused

wazuh low xml

sshd: connection reset

sshd: connection reset

wazuh low xml

Zeek: SSH Connection

Zeek: SSH Connection

sentinel medium kql

OCI - Inbound SSH connection

'Detects inbound SSH connection.'

sentinel high kql

OCI - SSH scanner

'Detects possible SSH scanning activity.'

wazuh low xml

sshd: configuration error (moduli).

sshd: configuration error (moduli).

wazuh informational xml

sshd: Host ungracefully disconnected.

sshd: Host ungracefully disconnected.

wazuh low xml

sshd: configuration error (AuthorizedKeysCommand)

sshd: configuration error (AuthorizedKeysCommand)

wazuh low xml

sshd: port forwarding issue

sshd: port forwarding issue

wazuh low xml

sshd: bad packet length

sshd: bad packet length

wazuh informational xml

sshd: No hostkey alg.

sshd: No hostkey alg.

wazuh informational xml

sshd: subsystem request failed.

sshd: subsystem request failed.

wazuh informational xml

Grouping macos sshd rules.

Grouping macos sshd rules.

wazuh informational xml

Jenkins: Started SSHD

Jenkins: Started SSHD

panther informational python

GCP Compute SSH Connection

Detect any SSH connections to a Compute Instance.

sagan low other

SSH-Tectia-Server detected

SSH-Tectia-Server detected

sentinel high kql

SSH Credentials Changed

Detects when SSH credentials are updated.