Elastic low stable kql

Successful SSH Authentication from Unusual User

This rule leverages the new_terms rule type to detect successful SSH authentications by a user who has not been authenticated in the last 5 days. This behavior may indicate an attacker attempting to gain access to the system using a valid account.

View Source

Detection Logic

event.category:authentication and host.os.type:linux and event.action:ssh_login and event.outcome:success

False Positives

  • ⚠ This rule may trigger in cases where a user has routine work patterns that result in infrequent authentications.

Field Validations

Loading…

Comments (0)

Loading comments...