[CISCO-IOS] Illegal User SSH

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[CISCO-IOS] Illegal User SSH"; content: "%DAEMON-3-SYSTEM_MSG
| 3a
| "; content: "Authentication failure for illegal user"; content: "sshd["; parse_src_ip: 1; default_proto: tcp; default_dst_port: $SSH_PORT; classtype: unsuccessful-admin; sid: 5001669; rev:7;)