Suspicious OpenSSH Daemon Error (via sshd)

title: Suspicious OpenSSH Daemon Error (via sshd)
id: 6c9ddd26-1291-5e44-9b6d-2fb4e3580611
status: stable
description: This rule detects anomalous SSH / SSHD error messages that indicate a fatal or anomalous error that could be caused by exploiting attempts
references:
    - https://attack.mitre.org/techniques/T1190/
    - https://github.com/openssh/openssh-portable/blob/c483a5c0fb8e8b8915fad85c5f6113386a4341ca/ssherr.c
    - https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/sshd_rules.xml
author: Huntrule Team
date: 2026-01-06
tags:
    - attack.initial-access
    - attack.t1190
logsource:
    product: linux
    service: sshd
detection:
    keywords:
        - 'unexpected internal error'
        - 'unknown or unsupported key type'
        - 'invalid certificate signing key'
        - 'invalid elliptic curve value'
        - 'incorrect signature'
        - 'error in libcrypto'
        - 'unexpected bytes remain after decoding'
        - 'fatal: buffer_get_string: bad string'
        - 'Local: crc32 compensation attack'
        - 'bad client public DH value'
        - 'Corrupted MAC on input'
    condition: keywords
falsepositives:
    - Unknown
level: medium