Potential SSH Brute Force Detected via macOS Security Events

  1[metadata]
  2creation_date = "2026/09/09"
  3integration = ["macos"]
  4maturity = "production"
  5updated_date = "2026/09/18"
  6
  7[rule]
  8author = ["Elastic"]
  9description = """
 10Identifies a high number of failed inbound SSH authentication attempts on a macOS host within a short time window,
 11using sshd authentication messages collected by the macOS Security Events integration. Adversaries may perform
 12password brute force or password spraying against exposed SSH services to obtain unauthorized access.
 13"""
 14from = "now-9m"
 15language = "esql"
 16license = "Elastic License v2"
 17name = "Potential SSH Brute Force Detected via macOS Security Events"
 18note = """## Triage and analysis
 19
 20> **Disclaimer**:
 21> This investigation guide was created using generative AI technology and has been reviewed to improve its accuracy and relevance. While every effort has been made to ensure its quality, we recommend validating the content and adapting it to suit your specific environment and operational needs.
 22
 23### Investigating Potential SSH Brute Force Detected via macOS Security Events
 24
 25On macOS, the `sshd-session` process logs every failed authentication attempt to the unified log (`Failed password for`, `Failed keyboard-interactive/pam for`,
 26`PAM: authentication error for`), and connections that probe a non-existent username end with `Connection closed by invalid user`.
 27This rule counts these failure messages per host and alerts when the number reaches the threshold within the rule window. 
 28Successful authentications are not counted. The rule extracts the targeted usernames and source IP addresses from the message text and reports them in the alert as `Esql.user_name_values`
 29and `Esql.source_ip_values`, with distinct counts in `Esql.user_name_count` and `Esql.source_ip_count`.
 30
 31### Possible investigation steps
 32
 33- Review `Esql.event_count`, `Esql.user_name_values`, and `Esql.source_ip_values` in the alert to identify how many
 34attempts occurred and which accounts and sources were involved.
 35- Use `Esql.user_name_count` and `Esql.source_ip_count` to characterize the activity: many usernames from one source
 36indicates password spraying, one username from one source indicates password guessing, and one username from many
 37sources indicates a distributed attack. Check whether the targeted usernames exist on the host.
 38- Check whether any `Accepted` message from `sshd-session` follows the failures in `logs-macos.authentication-*`, which
 39would indicate the attack succeeded.
 40- Determine whether the source IP addresses are internal or external and whether they are associated with known
 41infrastructure, scanners, or previous alerts.
 42- Determine whether Remote Login is expected to be enabled on this host (for example, build servers or developer
 43workstations).
 44- Correlate with other alerts or events from the same host during the same period.
 45
 46### Related rules
 47
 48- Potential Successful SSH Brute Force Attack via macOS Security Events - f5898b1e-3071-4597-b066-43d298c7b415
 49
 50### False positive analysis
 51
 52- Automation or configuration management tooling with stale or rotated credentials can generate bursts of failures,
 53typically from a single known source IP address against a single service account.
 54- Security scanners or credential-validation health checks that test SSH authentication against known hosts.
 55- Internet-facing SSH services may receive high volumes of scanning or credential-stuffing traffic from unrelated
 56sources; consider network-level rate limiting or exclusions for known source addresses.
 57- Users repeatedly mistyping a password rarely reach the threshold within the window due to PAM's per-attempt delay,
 58but multiple parallel sessions from the same user can approach it.
 59
 60### Response and remediation
 61
 62- Block or rate-limit the source IP addresses reported in `Esql.source_ip_values` at the network perimeter or on the
 63host.
 64- Verify no successful authentication followed the failures; if one did, treat the host as potentially compromised and
 65follow the response steps of the successful brute force rule.
 66- Reset credentials for the accounts reported in `Esql.user_name_values` if there is any indication they may be weak or
 67exposed.
 68- Review the host's SSH configuration: prefer key-based authentication, restrict access with `AllowUsers`/`AllowGroups`,
 69and disable Remote Login where it is not required.
 70- Escalate to the security operations team if additional hosts show similar patterns.
 71"""
 72references = ["https://themittenmac.com/detecting-ssh-activity-via-process-monitoring/"]
 73risk_score = 21
 74rule_id = "3751cc17-6e7e-4356-86d5-c8f44aab9a28"
 75setup = """## Setup
 76
 77This rule requires data from the macOS Security Events integration.
 78Integration setup instructions: [macOS Security Events](https://www.elastic.co/docs/reference/security/prebuilt-rules/integration/macos/macos_security_events)
 79SSH authentication logging setup instructions: [macOS Security Events: SSH Authentication](https://www.elastic.co/docs/reference/security/prebuilt-rules/integration/macos/macos_security_events_ssh_authentication)
 80"""
 81severity = "low"
 82tags = [
 83    "OS: macOS",
 84    "Use Case: Threat Detection",
 85    "Tactic: Credential Access",
 86    "Data Source: macOS Security Events",
 87    "Resources: Investigation Guide",
 88    "Rule Type: ES|QL",
 89    "Platform: macOS",
 90    "Domain: Endpoint",
 91]
 92timestamp_override = "event.ingested"
 93type = "esql"
 94query = '''
 95FROM logs-macos.authentication-*
 96| WHERE data_stream.dataset == "macos.authentication" and (
 97    macos.event.message.description LIKE "Failed password for*" or
 98    macos.event.message.description LIKE "Failed keyboard-interactive/pam for*" or
 99    macos.event.message.description LIKE "error: PAM: authentication error for*" or
100    macos.event.message.description LIKE "Connection closed by invalid user*"
101  )
102| GROK macos.event.message.description "for (invalid user )?%{NOTSPACE:Esql.user_name_attempt} from %{IP:Esql.source_ip_attempt}"
103| GROK macos.event.message.description "closed by invalid user %{NOTSPACE:Esql.user_name_probe} %{IP:Esql.source_ip_probe}"
104| EVAL Esql.user_name = COALESCE(Esql.user_name_attempt, Esql.user_name_probe),
105        Esql.source_ip = COALESCE(Esql.source_ip_attempt, Esql.source_ip_probe)
106| STATS
107    Esql.event_count = COUNT(*),
108    Esql.user_name_values = VALUES(Esql.user_name),
109    Esql.user_name_count = COUNT_DISTINCT(Esql.user_name),
110    Esql.source_ip_values = VALUES(Esql.source_ip),
111    Esql.source_ip_count = COUNT_DISTINCT(Esql.source_ip)
112  BY host.id, host.name
113| WHERE Esql.event_count >= 20
114| KEEP host.id, host.name, Esql.event_count, Esql.user_name_values, Esql.user_name_count, Esql.source_ip_values, Esql.source_ip_count
115'''
116
117[[rule.threat]]
118framework = "MITRE ATT&CK"
119
120[[rule.threat.technique]]
121id = "T1110"
122name = "Brute Force"
123reference = "https://attack.mitre.org/techniques/T1110/"
124
125[[rule.threat.technique.subtechnique]]
126id = "T1110.001"
127name = "Password Guessing"
128reference = "https://attack.mitre.org/techniques/T1110/001/"
129
130[[rule.threat.technique.subtechnique]]
131id = "T1110.003"
132name = "Password Spraying"
133reference = "https://attack.mitre.org/techniques/T1110/003/"
134
135[rule.threat.tactic]
136id = "TA0006"
137name = "Credential Access"
138reference = "https://attack.mitre.org/tactics/TA0006/"
139
140[[rule.threat]]
141framework = "MITRE ATT&CK"
142
143[[rule.threat.technique]]
144id = "T1133"
145name = "External Remote Services"
146reference = "https://attack.mitre.org/techniques/T1133/"
147
148[rule.threat.tactic]
149id = "TA0001"
150name = "Initial Access"
151reference = "https://attack.mitre.org/tactics/TA0001/"