HIDS 5551

From Atomicorp Wiki
Revision as of 19:31, 3 April 2014 by Mshinn (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Rule ID

5551

Status

Active rule currently published.

Description

This rule detects multiple login failures for services that use the generic Linux Programmable Authentication Modules system. The intent of this rule is to detect a malicious party attempting to brute force guess passwords.

The default settings are to detect 8 login failure, from the same IP, within 90 seconds.

False Positives

This rule can be falsely triggered if multiple users are using the same IP address, such as behind a firewall and multiple users generate 8 or more failures within 90 seconds.

If you believe that this is a false positive, then disable this rule or whitelist the source IP.

Tuning Recommendations

None.

Similar Rules

HIDS_3911

HIDS_3912

HIDS_3913

Personal tools