HighALERT-4211engine: heuristic

SSH Brute Force Against Server

analyst review

Raw alert — normalized QRadar offense

asset: billing-app-01
protocol: TCP :443
src_ip: 200.84.16.143
dest_ip: 10.20.6.21
magnitude: 7/10
severity: 6/10
credibility: 9/10
relevance: 5/10
src network: external
events / flows: 1,116 / 3,173

triggered rules

▹ Auth: Multiple Login Failures From Single Source
▹ Auth: Brute Force Login Attempt

full offense JSON

{
  "offense_id": 4211,
  "description": "SSH Brute Force Against Server :: Brute Force targeting billing-app-01",
  "offense_type": "Source IP",
  "offense_source": "200.84.16.143",
  "magnitude": 7,
  "severity": 6,
  "credibility": 9,
  "relevance": 5,
  "status": "OPEN",
  "source_network": "external",
  "destination_networks": [
    "internal_corp"
  ],
  "event_count": 1116,
  "flow_count": 3173,
  "start_time": "2025-11-03T08:45:00+00:00",
  "last_updated_time": "2025-11-03T09:16:00+00:00",
  "categories": [
    "Authentication",
    "User Login Failure"
  ],
  "rules": [
    "Auth: Multiple Login Failures From Single Source",
    "Auth: Brute Force Login Attempt"
  ],
  "assigned_to": null,
  "dest_port": 443
}

AI triage

Likely brute force: SSH Brute Force Against Server from external source 200.84.16.143 against billing-app-01 (10.20.6.21) over TCP, 1,116 events observed.

MITRE ATT&CK

T1110Brute ForceCredential Accessconfidence 92%

Alert indicators (SSH Brute Force Against Server; rules: Auth: Multiple Login Failures From Single Source) overlap most strongly with T1110 Brute Force among the ATT&CK shortlist.

Priority — High

Scored High based on: QRadar magnitude 7/10; source is external to the network; credibility 9/10.

Recommended next steps

1.Identify the targeted account(s) and whether any authentication succeeded.
2.If a login succeeded, treat as a confirmed compromise and reset credentials immediately.
3.Enforce/verify account lockout and MFA on the targeted service.
4.Block the source IP and hunt for the same source against other assets.

Suggested hunting query (KQL)

SecurityEvent
| where TimeGenerated > ago(24h)
| where IpAddress == "200.84.16.143" and EventID in (4625, 4624)
| summarize Failures=countif(EventID==4625), Successes=countif(EventID==4624) by Account, Computer

ATT&CK candidate shortlist — matched before the model was called, so it justifies from real technique IDs

T1110Brute Force·11T1078Valid Accounts·5.5T1098.004SSH Authorized Keys·3.5T1547.002Authentication Package·3.5T1621Multi-Factor Authentication Request Generation·3.5T1027.004Compile After Delivery·3T1201Password Policy Discovery·3