Detectionmediumtest

Suspicious OpenSSH Daemon Error

Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Florian Roth (Nextron Systems)Created Fri Jun 30Updated Sat Nov 27e76b413a-83d0-4b94-8e4c-85db4a5b8bdclinux

Log Source

Linuxsshd

ProductLinux← raw: linux

Servicesshd← raw: sshd

Detection Logic

detection:
    keywords:
        - 'unexpected internal error'
        - 'unknown or unsupported key type'
        - 'invalid certificate signing key'
        - 'invalid elliptic curve value'
        - 'incorrect signature'
        - 'error in libcrypto'
        - 'unexpected bytes remain after decoding'
        - 'fatal: buffer_get_string: bad string'
        - 'Local: crc32 compensation attack'
        - 'bad client public DH value'
        - 'Corrupted MAC on input'
    condition: keywords