All rules

Sigma

title: Cowrie Failed Login
name: cowrie_failed_login
id: 6d7c9668-0a0b-416f-aa47-e1f215917342
status: experimental
description: Base rule for the password guessing correlation.
author: Estul Lachin
date: 2026-11-08
logsource:
  product: cowrie
detection:
  selection:
    eventid: cowrie.login.failed
  condition: selection
level: informational
---
title: Password Guessing From One Source
id: 9a1edbdd-3518-4170-a9f7-7d476a9221d1
status: experimental
description: |
  One source tries five or more different passwords within ten minutes. Counting distinct passwords
  rather than failed logins ignores a client that retries the same wrong password, and catches
  dictionary attacks even when they are slow per connection.
references:
  - https://attack.mitre.org/techniques/T1110/001/
author: Estul Lachin
date: 2026-11-08
tags:
  - attack.credential-access
  - attack.t1110.001
correlation:
  type: value_count
  rules:
    - cowrie_failed_login
  group-by:
    - src_ip
  timespan: 10m
  condition:
    gte: 5
    field: password
falsepositives:
  - A user who forgot their password and tries many variants (rarely five within ten minutes)
level: medium

rules/ssh_password_guessing.yml

Splunk SPL

``` Password Guessing From One Source. Generated from rules/ssh_password_guessing.yml by tools/build.py; do not edit. ```
index=honeypot sourcetype=cowrie:json eventid="cowrie.login.failed"
| bin _time span=10m
| stats dc(password) as value_count by _time src_ip
| search value_count >= 5

Verified in Splunk against the test events. dist/spl/ssh_password_guessing.spl

Microsoft Sentinel KQL

// Password Guessing From One Source. Generated from rules/ssh_password_guessing.yml by tools/build.py; do not edit.
Cowrie_CL
| where (eventid =~ "cowrie.login.failed")
| summarize value_count = dcount(password) by bin(TimeGenerated, 10m), src_ip
| where value_count >= 5

For a custom table Cowrie_CL with Cowrie's field names. Converted, not yet run in Sentinel. dist/kql/ssh_password_guessing.kql