macos | Detection.FYI

Potential SSH Brute Force Detected via macOS Security Events

Sep 19, 2026 · OS: macOS Use Case: Threat Detection Tactic: Credential Access Data Source: macOS Security Events Resources: Investigation Guide Rule Type: ES|QL Platform: macOS Domain: Endpoint ·
Share on:

Identifies a high number of failed inbound SSH authentication attempts on a macOS host within a short time window, using sshd authentication messages collected by the macOS Security Events integration. Adversaries may perform password brute force or password spraying against exposed SSH services to obtain unauthorized access.

Read More
Potential Successful SSH Brute Force Attack via macOS Security Events

Sep 19, 2026 · OS: macOS Use Case: Threat Detection Tactic: Credential Access Tactic: Initial Access Data Source: macOS Security Events Resources: Investigation Guide Rule Type: Event Correlation (EQL) Platform: macOS Domain: Endpoint ·
Share on:

Identifies a burst of failed inbound SSH authentication attempts on a macOS host followed shortly by a successful SSH authentication on the same host, using sshd authentication messages collected by the macOS Security Events integration. A successful login immediately after repeated failures indicates that a password brute force or password spraying attack against an exposed SSH service has likely succeeded.

Read More