SSH Time-Based Bruteforce
Attack scenariossh:bruteforceMITRE T1110
- Version
- 0.3
- Name
- crowdsecurity/ssh-time-based-bf
- Remediation
- Alert only
Detect time-based ssh bruteforce attempts that evade rate limiting (with false positive reduction)
Install with a top-level collection
5 collections include itsudo cscli collections install crowdsecurity/openbsdInstalls 6 parsers and 6 scenarios, via SSHD - Bruteforce Protection.
View OpenBSD →Installation
sudo cscli scenarios install crowdsecurity/ssh-time-based-bfThen reload CrowdSec: sudo systemctl reload crowdsec
Sign in to see which of your engines run it →Configuration
Hover a line or a note to see what each field does.
# ssh time-based bruteforce with false positive reductiontype: conditionalname: crowdsecurity/ssh-time-based-bfdescription: "Detect time-based ssh bruteforce attempts that evade rate limiting (with false positive reduction)"filter: "evt.Meta.service == 'ssh' && evt.Meta.log_type in ['ssh_failed-auth', 'auth_success']"groupby: evt.Meta.source_ipcapacity: -1cancel_on: "evt.Meta.log_type == 'auth_success'"condition: |let failedAuths = filter(queue.Queue, {#.Meta.log_type == 'ssh_failed-auth'});len(failedAuths) >= 4 &&MedianInterval(map(failedAuths[-4:], {#.Time})) > duration("10m")leakspeed: 2hblackhole: 5mreprocess: truelabels:service: sshbehavior: "ssh:bruteforce"spoofable: 0confidence: 1classification:- attack.T1110label: "SSH Time-Based Bruteforce"remediation: false---# ssh user-enum time-based with false positive reductiontype: conditionalname: crowdsecurity/ssh-time-based-bf_user-enumdescription: "Detect time-based ssh user enum bruteforce attempts (with false positive reduction)"filter: "evt.Meta.service == 'ssh' && evt.Meta.log_type in ['ssh_failed-auth', 'auth_success']"groupby: evt.Meta.source_ipdistinct: evt.Meta.target_usercapacity: -1cancel_on: "evt.Meta.log_type == 'auth_success'"condition: |let failedAuths = filter(queue.Queue, {#.Meta.log_type == 'ssh_failed-auth'});len(failedAuths) >= 4 &&MedianInterval(map(failedAuths[-4:], {#.Time})) > duration("10m")leakspeed: 2hblackhole: 5m
Installed on
Know where it runs
Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.
Documentation
Detect time-based ssh bruteforce attempts that evade traditional rate limiting with false positive reduction:
- Uses conditional type with capacity -1 (unlimited)
- Triggers when at least 4 failed authentication attempts occur
- Median interval between failed attempts exceeds 10 minutes
- False positive reduction: Uses
cancel_onto cancel bucket if user successfully authenticates- Prevents "forgot password" scenarios from triggering alerts
- Standard variant: Cancels on ANY successful login from same IP
- User-enum variant: Only cancels for same IP + same username combination
- Attackers trying multiple usernames won't be excused by one success (in user-enum variant)
- Leakspeed of 2h naturally caps maximum interval (~40-60 minutes for 3 events)
- Remediation disabled (labels set to
remediation: false) - Uses
MedianInterval()helper to detect consistent timing patterns (more robust against outliers) - Requires
crowdsecurity/sshd-success-logsparser for cancel_on functionality
Two variants:
- ssh-time-based-bf: Standard bruteforce detection (4 failed logins from same IP)
- ssh-time-based-bf_user-enum: User enumeration detection (4 distinct usernames from same IP)
This scenario complements the standard ssh-bf (capacity 5, leakspeed 10s) and ssh-slow-bf (capacity 10, leakspeed 60s) scenarios with no overlap:
- ssh-bf catches 5 failures within ~50 seconds (rate-based)
- ssh-slow-bf catches 10 failures within ~10 minutes (rate-based)
- ssh-time-based-bf catches 4 failures with median interval >10 minutes (time-pattern-based, naturally capped by 2h leakspeed)