cscli scenarios install LePresidente/ssh-bad-keyexchange-bfDetect failed ssh Key Exchanges :
1# ssh bruteforce2type: leaky3name: lepresidente/ssh-bad-keyexchange-bf4description: "Detect ssh bad key exchange"5filter: "evt.Meta.log_type == 'ssh_bad_keyexchange'"6leakspeed: "10s"7references:8 - http://wikipedia.com/ssh-bf-is-bad9capacity: 510groupby: evt.Meta.source_ip11blackhole: 1m12reprocess: true13labels:14 service: ssh15 behavior: "ssh:bruteforce"16 confidence: 317 spoofable: 018 classification:19 - attack.T111020 remediation: true21 label: "SSH Bad Key Bruteforce"22