SSH Brute-Force Followed by Successful Authentication (External Source)
Detects a high volume of failed SSH password authentication attempts from a single source IP address against one or more target hosts within a short time window, which is indicative of an SSH brute-force attack.
Sigma
