['flow', 'ssh']
src_ip: 172.16.0.1, src_port: 49300, dest_ip: 192.168.10.50, dest_port: 22, event_type: flow, proto: TCP, app_proto: ssh, flow_pkts_toserver: 21, flow_pkts_toclient: 34, flow_bytes_toserver: 3402, flow_bytes_toclient: 4997, flow_age: 12, flow_state: closed, flow_reason: timeout, tcp_tcp_flags: 1b, tcp_tcp_flags_ts: 1b, tcp_tcp_flags_tc: 1b, tcp_syn: True, tcp_fin: True, tcp_psh: True, tcp_ack: True, tcp_state: closed ; pcap_cnt: 9789572, event_type: ssh, proto: TCP, tx_id: 0, ssh_client_proto_version: 2.0, ssh_client_software_version: paramiko_2.0.0, ssh_client_hassh_hash: c6f5e6d54285a11b9f02fef7fc77bd6f, ssh_client_hassh_string: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1,diffie-hellman-group-exchange-sha1,diffie-hellman-group-exchange-sha256;aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,blowfish-cbc,aes192-cbc,aes256-cbc,3des-cbc,arcfour128,arcfour256;hmac-sha2-256,hmac-sha2-512,hmac-md5,hmac-sha1-96,hmac-md5-96,hmac-sha1;none, ssh_server_proto_version: 2.0, ssh_server_software_version: OpenSSH_7.2p2, ssh_server_hassh_hash: d43d91bc39d5aaed819ad9f6b57b7348, ssh_server_hassh_string: curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha1;chacha20-poly1305@openssh.com,aes128-ctr,aes192-ctr,aes256-ctr,aes128-gcm@openssh.com,aes256-gcm@openssh.com;umac-64-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-256-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-64@openssh.com,umac-128@openssh.com,hmac-sha2-256,hmac-sha2-512,hmac-sha1;none,zlib@openssh.com
The network event indicates a SSH-Patator. SSH-Patator attacks involve brute force attempts to gain access to an SSH server. Typically, the logs show multiple login attempts from the same source IP to the SSH server, often with varied credentials. This pattern of behavior is consistent with brute force attacks aiming to discover valid username and password combinations. Additionally, the logs show multiple established connections that are short-lived, frequently terminated due to `timeout`, and detailed SSH protocol negotiations. These characteristics align with the behavior of automated tools like SSH-Patator, which issue numerous login attempts rapidly.
classification: Attack
justification: The network event indicates a SSH-Patator. SSH-Patator attacks involve brute force attempts to gain access to an SSH server. Typically, the logs show multiple login attempts from the same source IP to the SSH server, often with varied credentials. This pattern of behavior is consistent with brute force attacks aiming to discover valid username and password combinations. Additionally, the logs show multiple established connections that are short-lived, frequently terminated due to `timeout`, and detailed SSH protocol negotiations. These characteristics align with the behavior of automated tools like SSH-Patator, which issue numerous login attempts rapidly.