kqlElastic-2.0from elastic/detection-rules
Potential macOS SSH Brute Force Detected
Quality
92
FP risk
—
Forks
0
Views
0
Rule sourcerules/macos/credential_access_potential_macos_ssh_bruteforce.toml
event.category:process and host.os.type:macos and event.type:start and process.name:"sshd-keygen-wrapper" and process.parent.name:launchd