1200KM / sigma-rule

Suspicious OpenSSH Daemon Error — Sigma Rule

Sigma rule e76b413a-83d0-4b94-8e4c-85db4a5b8bdc. Suspicious OpenSSH Daemon Error — Sigma Rule. Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts

Rule metadata and linked tags

Author: Florian Roth (Nextron Systems). Source status: test; severity: medium. Source dates: 2017-06-30 / 2021-11-27.

{
  "product": "linux",
  "service": "sshd"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: 8e0302ef07eabcb04ee3d63ffcedce173270ca20e6b6213c83a3d7db8630ce9e

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Suspicious OpenSSH Daemon Error
id: e76b413a-83d0-4b94-8e4c-85db4a5b8bdc
status: test
description: Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
references:
    - https://github.com/openssh/openssh-portable/blob/c483a5c0fb8e8b8915fad85c5f6113386a4341ca/ssherr.c
    - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/sshd_rules.xml
author: Florian Roth (Nextron Systems)
date: 2017-06-30
modified: 2021-11-27
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    product: linux
    service: sshd
detection:
    keywords:
        - 'unexpected internal error'
        - 'unknown or unsupported key type'
        - 'invalid certificate signing key'
        - 'invalid elliptic curve value'
        - 'incorrect signature'
        - 'error in libcrypto'
        - 'unexpected bytes remain after decoding'
        - 'fatal: buffer_get_string: bad string'
        - 'Local: crc32 compensation attack'
        - 'bad client public DH value'
        - 'Corrupted MAC on input'
    condition: keywords
falsepositives:
    - Unknown
level: medium

Original YAML and metadata in JSON

False positives

Unknown

Source references

Connected ecosystem references

Exact source-tagged techniques

T1190 · Exploit Public-Facing Application · Detection rules & anomalies

Telemetry review

Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.