I wrote this rule so that when there are more than three failed SSH connection attempts that there is an alert but it is not working. Are these rules badly written? Or if not I ask the exact writing of the rule.

It's an emergency it's for a sustain in a few weeks...

This is my rule:

alert tcp any -> 22 ( 
msg:"SSH Brute Force Attempt";
content:"SSH"; nocase; offset:0; depth:3; 
detection_filter:track by_src, count 3, seconds 60; 
sid:10000001; rev:1;)
  • If you have a few weeks, I don't think it's an emergency. You can learn Snort syntax in a day. – forest Jul 24 '18 at 10:31
  • Have you ran a sniffing tool and simulated the traffic you are writing the rule to detect? – Damian T. Jul 24 '18 at 12:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.