Elastic low stable kql

Successful SSH Authentication from Unusual SSH Public Key

This rule leverages the new_terms rule type to detect successful SSH authentications via a public key that has not been seen in the last 5 days. Public key authentication is a secure method for authenticating users to a server. Monitoring unusual public key authentication events can help detect unauthorized access attempts or suspicious activity on the system.

View Source

Detection Logic

event.category:authentication and host.os.type:linux and event.action:ssh_login and event.outcome:success and system.auth.ssh.method:publickey

False Positives

  • ⚠ This rule may trigger in cases where a user has routine work patterns that result in infrequent authentications.

Field Validations

Loading…

Comments (0)

Loading comments...