Linux SSHD Logs: Suspicious OpenSSH Daemon Error Keywords
Alerts on sshd log entries with specific OpenSSH fatal or cryptographic error messages indicating suspicious access attempts.
- Product
- linux
- Service
- sshd
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2017-06-30
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches specific OpenSSH/sshd error text patterns in Linux SSHD logs that indicate unexpected, fatal, cryptographic, or malformed-input failures. Such messages can occur when an attacker attempts to exploit SSH protocol parsing or crypto handling behavior. It relies on the presence of these exact error keywords in sshd service logs.
Reporting behind it
- github.comhttps://github.com/openssh/openssh-portable/blob/c483a5c0fb8e8b8915fad85c5f6113386a4341ca/ssherr.c
- github.comhttps://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/sshd_rules.xml
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/sshd/lnx_sshd_susp_ssh.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux SSHD Logs: Suspicious OpenSSH Daemon Error Keywords"
id: 5da0b54b-aeeb-4533-8fb7-0de546bea155
status: test
description: This rule matches specific OpenSSH/sshd error text patterns in Linux SSHD logs that indicate unexpected, fatal, cryptographic, or malformed-input failures. Such messages can occur when an attacker attempts to exploit SSH protocol parsing or crypto handling behavior. It relies on the presence of these exact error keywords in sshd service logs.
references:
- https://github.com/openssh/openssh-portable/blob/c483a5c0fb8e8b8915fad85c5f6113386a4341ca/ssherr.c
- https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/sshd_rules.xml
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/sshd/lnx_sshd_susp_ssh.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-06-30
modified: 2021-11-27
tags:
- attack.initial-access
- attack.t1190
logsource:
product: linux
service: sshd
detection:
keywords:
- unexpected internal error
- unknown or unsupported key type
- invalid certificate signing key
- invalid elliptic curve value
- incorrect signature
- error in libcrypto
- unexpected bytes remain after decoding
- "fatal: buffer_get_string: bad string"
- "Local: crc32 compensation attack"
- bad client public DH value
- Corrupted MAC on input
condition: keywords
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: e76b413a-83d0-4b94-8e4c-85db4a5b8bdc
type: derived