Any IP which succeeds at logging in via SSH after a failed login attempt is worth a look--it could indicate that a brute-force attempt has succeeded. This query builds up a table of successful SSH logins from system logs, then checks all failed attempts to see if that IP has ever successfully logged in. It builds a table of the output.
The Query:
@successful{tag=syslog words Accepted
| syslog Appname==sshd Hostname Message
| regex -e Message "Accepted (?P<method>\S+) for (?P<user>\S+) from (?P<ip>\S+)"
| unique method user ip Hostname
| table user ip Hostname};
tag=syslog words authenticating user
| syslog Appname==sshd Hostname Message
| regex "(Disconnected from|Connection closed by) authenticating user (?P<failed_user>\S+) (?P<failed_ip>\S+)"
| alias Hostname failed_hostname
| lookup -s -r @successful failed_ip ip (Hostname as successful_hostname user as successful_user)
| table failed_ip failed_hostname failed_user successful_hostname successful_user
Visit gravwell.io/query to view an archive of our previous Query of the Week posts.
