Recipe: Windows OpenSSH

[landon-lengyel]

The Windows OpenSSH feature seems to log SSH connections a little differently than OpenSSH for Linux. Here is the recipe I'm using to detect authentications, let me know if anyone has any improvements.

<LogFile>

  <Source>SSH</Source>

  <PathAndMask>C:/ProgramData/ssh/logs/sshd.log</PathAndMask>

  <FailedLoginRegex>
    <![CDATA[
        (?i)(?<timestamp>\d\d\d\d\-\d\d\-\d\d\s\d\d\:\d\d\:\d\d)\.\d+\s+(?<log>Disconnecting\sinvalid\suser)\s+(?<username>[^\s]+)\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+|
        (?i)(?<timestamp>\d\d\d\d\-\d\d\-\d\d\s\d\d\:\d\d\:\d\d)\.\d+\s+(?<log>Connection\sreset\sby\sinvalid\suser)\s+(?<username>[^\s]+)\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+|
        (?i)(?<timestamp>\d\d\d\d\-\d\d\-\d\d\s\d\d\:\d\d\:\d\d)\.\d+\s+(?<log>Failed\s+(password|public key))\s+for\s+(?:invalid\s+user\s+)?(?<username>[^\s]+)\s+from\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+ssh
    ]]>
  </FailedLoginRegex>

  <SuccessfulLoginRegex>
    <![CDATA[
      (?i)(?<timestamp>\d\d\d\d\-\d\d\-\d\d\s\d\d\:\d\d\:\d\d)\.\d+\s+(?<log>Accepted\s+(?:password|publickey))\s+for\s+(?<username>[^\s]+)\s+from\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+ssh          
    ]]>
  </SuccessfulLoginRegex>

  <PlatformRegex>Windows</PlatformRegex>
  <PingInterval>10000</PingInterval>
  <MaxFileSize>0</MaxFileSize>
  <FailedLoginThreshold>0</FailedLoginThreshold>

</LogFile>

[jjxtra]

This is the built in config for IPBan for OpenSSH event viewer on Windows. Looks like some differences.

<Group>
  <Source>SSH</Source>
  <Keywords>0x4000000000000000</Keywords>
  <Path>OpenSSH/Operational</Path>
  <FailedLoginThreshold>0</FailedLoginThreshold>
  <Expressions>
    <Expression>
      <XPath>//Data[@Name='payload']</XPath>
      <Regex>
        <![CDATA[
          (?<log>failed\s+password)\s+for\s+(invalid\s+user\s+)?(?<username>[^\s]+)\s+from\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+ssh|
          (?<log>did\s+not\s+receive\s+identification\s+string)\s+from\s+(?<ipaddress>[^\s]+)|
          (?<log>connection\s+closed)\s+by\s+((invalid\s+user\s+)?(?<username>[^\s]+)\s+)?(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+\[preauth\]|
          (?<log>disconnected\s+from)\s+(invalid\s+user\s+)?(?<username>[^\s]+)\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+\[preauth\]|
          (?<log>disconnected\s+from)\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+\[preauth\]|
          (?<log>disconnected\s+from\s+authenticating\s+user)\s+(?<username>[^\s]+)\s+(?<ipaddress>[^\s]+)\s+port\s+[0-9]+\s+\[preauth\]
        ]]>
      </Regex>
    </Expression>
  </Expressions>
</Group>

[landon-lengyel]

Unbelievable, my selective vision strikes again! That one looks great, thank you.