Suspicious OpenSSH Daemon Error

Title: Suspicious OpenSSH Daemon Error
Status: test
Description:Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
References:
  -https://github.com/openssh/openssh-portable/blob/c483a5c0fb8e8b8915fad85c5f6113386a4341ca/ssherr.c
  -https://github.com/ossec/ossec-hids/blob/1ecffb1b884607cb12e619f9ab3c04f530801083/etc/rules/sshd_rules.xml
Author: Florian Roth (Nextron Systems)
Date: 2017-06-30
modified:2021-11-27
Tags:

• -'attack.initial-access'
• -'attack.t1190'

Logsource:

• product: linux
• service: sshd

Detection:
  keywords:
    - 'unexpected internal error'
    - 'unknown or unsupported key type'
    - 'invalid certificate signing key'
    - 'invalid elliptic curve value'
    - 'incorrect signature'
    - 'error in libcrypto'
    - 'unexpected bytes remain after decoding'
    - 'fatal: buffer_get_string: bad string'
    - 'Local: crc32 compensation attack'
    - 'bad client public DH value'
    - 'Corrupted MAC on input'
  condition:keywords
Falsepositives:
  -Unknown
Level: medium