The quiet hour
Twenty-eight hourly SSH login buckets, sorted. One hour inside the peak activity dropped to seven attempts while the hours either side exceeded four hundred each.
Seven attempts in one hour. The hour before had four hundred eighty two. The hour after had four hundred thirty nine.
People picture brute force as a constant background hum. Twenty-eight hours of recorded data say otherwise.
Sort the hourly buckets by count. The top four all clear four hundred. The highest is six hundred twelve. Then three consecutive hours at six in the morning: four hundred eighty two, then seven, then four hundred thirty nine. One source network accounts for sixty-one percent of all traffic. The seven is not background noise. It is the pause between two strikes.
A firewall rule built for sustained traffic will let all of this through. Any threshold tuned for continuous rates is the wrong shape for a campaign that pulses.
Set your alerts for hourly spikes, not just sustained rates.
#linux#security#ssh#honeypot#sysadmin
❯ Set your alerts for hourly spikes, not just sustained rates.