SSH Brute-Force Detection - 10+ Attempts in 60s on Port 22

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects multiple TCP synchronization (SYN) packets targeting the SSH service (port 22) from a single source IP address within a short timeframe. This behavior is indicative of a brute-force or credential-guessing attack against the SSH service.