1# ssh bruteforce
2type: leaky
3name: lepresidente/ssh-bad-keyexchange-bf
4description: "Detect ssh bad key exchange"
5filter: "evt.Meta.log_type == 'ssh_bad_keyexchange'"
6leakspeed: "10s"
7references:
8  - http://wikipedia.com/ssh-bf-is-bad
9capacity: 5
10groupby: evt.Meta.source_ip
11blackhole: 1m
12reprocess: true
13labels:
14  service: ssh
15  behavior: "ssh:bruteforce"
16  confidence: 3
17  spoofable: 0
18  classification:
19    - attack.T1110
20  remediation: true
21  label: "SSH Bad Key Bruteforce"
22