# Synthetic demonstration — not a client incident

Generated from the portfolio’s SSH test fixture. No external enrichment was requested.

# TRG-YGGNBG-5763 — sshd: brute force trying to get access to the system. Authentication failed.

| Field | Value |
|---|---|
| Severity | **HIGH** (score 75/100, suggested) |
| Verdict | **true positive** (suggested — analyst to confirm) |
| Wazuh rule | 5763 (level 10) — sshd: brute force trying to get access to the system. Authentication failed. |
| Agent | lab-ubuntu-01 (10.0.20.15) |
| Time (UTC) | 2026-09-12T14:03:18.412+0000 |
| MITRE ATT&CK | T1110.001, T1110 |
| ASD Essential Eight | E8-07 Multi-Factor Authentication |

## Summary
sshd: brute force trying to get access to the system. Authentication failed. on lab-ubuntu-01 by root from 185.220.101.34. Suggested true positive (high).

## Indicators
| Type | Value | Context | Enrichment |
|---|---|---|---|
| ip | `10[.]0[.]20[.]15` | agent |  |
| ip | `185[.]220[.]101[.]34` | public | not enriched |
| file | `/var/log/auth[.]log` | path |  |
| user | `root` | subject |  |
| host | `lab-ubuntu-01` | agent |  |

## Why this verdict
- +20 — Wazuh level 10
- +35 — Failures followed by a SUCCESSFUL logon from the same source — brute force that worked
- +10 — Privileged account targeted
- +10 — Public IP involved: 185.220.101.34 — enrich for reputation

## Recommended action
1. Check for a successful logon from the same source in the surrounding 30 minutes; if found, treat as account compromise.
2. Block the source at the perimeter and reset the targeted account.
3. Map to E8-07 for the client's Essential Eight report.

## Evidence to attach
- Raw alert JSON (rule 5763, 2026-09-12T14:03:18.412+0000)
- full_log line and previous_output
- Reputation lookups for public IPs

_Generated by Wazuh Alert Triage Assistant — suggestions only; the analyst owns the verdict._