Add rule detecting inbound SSH drops on MikroTik WAN

[OriolesMagic333]

Summary of the Pull Request

This PR adds a new rule to detect automated reconnaissance and SSH scanning directed at the external WAN interface of MikroTik edge routers. It utilizes parsed firewall logs to identify dropped TCP connections targeting port 22, which is indicative of internet background radiation or targeted brute-force setup phases.

Changelog

new: MikroTik Inbound SSH Drop on WAN

Example Log Event

{
  "in_interface": "ether5[WAN]",
  "dst_port": 22,
  "protocol": "TCP",
  "message": "firewall,info PW_DROP_INPUT input: in:ether5[WAN] out:(unknown 0), proto TCP (SYN), 203.0.113.5:44342->192.168.88.10:22, len 52"
}

Fixed Issues

N/A

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[github-actions]

Welcome @OriolesMagic333 👋

It looks like this is your first pull request on the Sigma rules repository!

Please make sure to read the SigmaHQ conventions to make sure your contribution is adhering to best practices and has all the necessary elements in place for a successful approval.

Thanks again, and welcome to the Sigma community! 😃

If you want to engage more with the community for official support, general discussions or announcements:

👉 Join our Discord server