SSH Refused Connection Detection Scenario by crowdsecurity | CrowdSec Hub

SSH Refused Connection

Attack scenariogeneric:scanMITRE T1595

By: crowdsecurity
Version: 0.1
Name: crowdsecurity/ssh-refused-conn
Remediation: Ban

Detect sshd refused connections

Install with a top-level collection

5 collections include it

sudo cscli collections install crowdsecurity/openbsd

Installs 6 parsers and 6 scenarios, via SSHD - Bruteforce Protection.

View OpenBSD →

Installation

sudo cscli scenarios install crowdsecurity/ssh-refused-conn

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/ssh-refused-conn.yaml· 16 linesGitHub

1type: trigger1
2name: crowdsecurity/ssh-refused-conn
3description: "Detect sshd refused connections"
4filter: "evt.Meta.log_type == 'ssh_refused_conn'"2
5groupby: evt.Meta.source_ip3
6blackhole: 1m4
7reprocess: false
8labels:
9  service: ssh
10  confidence: 0
11  spoofable: 0
12  classification:5
13    - attack.T1595
14  label: "SSH Refused Connection"
15  behavior: "generic:scan"
16  remediation: true6

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

Detect refused connections to SSHD based on hosts deny and allow rules.

Typically these are defined in different locations based on the distribution.

For Debian/Ubuntu: /etc/hosts.deny and /etc/hosts.allow