[OPENSSH] Suspicious login to a nologin account

alert any $EXTERNAL_NET any -> $HOME_NET any (msg: "[OPENSSH] Suspicious login to a nologin account"; meta_content: "%sagan%",authentication accepted for, authenticated; meta_nocase; meta_content: "%sagan%",apache,tomcat,sys,www,nobody,nogroup,portmap,named,rpc,mail,ftp,shutdown,halt,daemon,bin,postfix,shell,info,guest,psql,user,users,console,uucp,lp,sync,sshd,cdrom,ossec,sagan,www-data; content:!"preauth"; nocase; parse_src_ip: 1; parse_port; default_proto: tcp; default_dst_port: $SSH_PORT; json_map: "dest_ip", ".xff"; threshold: type suppress, track by_dst, count 1, seconds 60; classtype: successful-user; program: sshd; sid: 5000411; rev:10;)