Elastic Security Detection Rules

Potential Malware-Driven SSH Brute Force Attempt

Last updated 16 days ago on 2025-04-07
Created 2 months ago on 2025-02-20

About

This detection identifies a Linux host that has potentially been infected with malware and is being used to conduct brute-force attacks against external systems over SSH (port 22 and common alternative SSH ports). The detection looks for a high volume of outbound connection attempts to non-private IP addresses from a single process. A compromised host may be part of a botnet or controlled by an attacker, attempting to gain unauthorized access to remote systems. This behavior is commonly observed in SSH brute-force campaigns where malware hijacks vulnerable machines to expand its attack surface. ES|QL rules have limited fields available in its alert documents. Make sure to review the original documents to aid in the investigation of this alert.
Tags
Domain: EndpointOS: LinuxUse Case: Threat DetectionTactic: ImpactTactic: ExecutionTactic: Command and ControlData Source: Elastic DefendLanguage: esql
Severity
medium
Risk Score
47
MITRE ATT&CK™

Impact (TA0040)(opens in a new tab or window)

↳ Resource Hijacking (T1496)(opens in a new tab or window)

Execution (TA0002)(opens in a new tab or window)

↳ Command and Scripting Interpreter (T1059)(opens in a new tab or window)

Command and Control (TA0011)(opens in a new tab or window)

↳ Application Layer Protocol (T1071)(opens in a new tab or window)

License
Elastic License v2(opens in a new tab or window)

Definition

Integration Pack
Prebuilt Security Detection Rules
Related Integrations

endpoint(opens in a new tab or window)

Query
from logs-endpoint.events.network-*
| keep @timestamp, host.os.type, event.type, event.action, destination.port, process.executable, destination.ip, agent.id, host.name
| where @timestamp > now() - 1 hours
| where host.os.type == "linux" and event.type == "start" and event.action == "connection_attempted" and
  destination.port in (22, 222, 2222, 10022, 2022, 2200, 62612, 8022) and not
     CIDR_MATCH(
       destination.ip, "10.0.0.0/8", "127.0.0.0/8", "169.254.0.0/16", "172.16.0.0/12", "192.0.0.0/24", "192.0.0.0/29", "192.0.0.8/32", "192.0.0.9/32",
       "192.0.0.10/32", "192.0.0.170/32", "192.0.0.171/32", "192.0.2.0/24", "192.31.196.0/24", "192.52.193.0/24", "192.168.0.0/16", "192.88.99.0/24",
       "224.0.0.0/4", "100.64.0.0/10", "192.175.48.0/24","198.18.0.0/15", "198.51.100.0/24", "203.0.113.0/24", "224.0.0.0/4", "240.0.0.0/4", "::1",
       "FE80::/10", "FF00::/8"
     )
| stats cc = count(), agent_count = count_distinct(agent.id), host.name = VALUES(host.name), agent.id = VALUES(agent.id) by process.executable, destination.port
| where agent_count == 1 and cc > 15
| sort cc asc
| limit 100

Install detection rules in Elastic Security

Detect Potential Malware-Driven SSH Brute Force Attempt in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(opens in a new tab or window).