sshd: User entered incorrect password.

Description

match="Invalid credentials"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

1. 5700 SSHD messages grouped. anchor level 0
   decoded_as=sshd
2. 5733 sshd: User entered incorrect password. suppression level 0 this rule
   match="Invalid credentials"

Rule dependencies

Depends on

• composes · Wazuh if_sid 5700
  • SSHD messages grouped.