regreSSHion (CVE-2024-6387)

title: OpenSSH Timeout Before Authentication
id: 02a549cd-caf6-5a1e-bb3d-3652385d99ec
status: experimental
description: Matches sshd "Timeout before authentication" messages. Exploiting CVE-2024-6387 (regreSSHion) needs thousands of connections held until LoginGraceTime, so a sharp rise in these messages on an unpatched host is the signal. Alert on volume per host or source, not single events.
references:
    - https://www.splunk.com/en_us/blog/security/cve-2024-6387-regresshion-vulnerability.html
    - https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
author: vuln2shell
date: 2026-10-23
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2024-6387
logsource:
    product: linux
    service: sshd
detection:
    keywords:
        - 'Timeout before authentication'
    condition: keywords
falsepositives:
    - Internet scanners and brute-force noise also produce this message
level: low

sourcetype=journald OR sourcetype=linux:auth OR TERM(sshd) OR TERM(ssh)
TERM(Timeout) TERM(authentication) "Timeout before authentication"
| timechart count by host

// KQL for detecting potential hashtag#RegreSSHion abuse
// https://www.linkedin.com/posts/activity-7214588446722465792-FwFr/

// ** Assumption **
// Firewall logs stream to CommonSecurityLog 
// 6 OpenSSH connections per min for minimum 6 hours
// 6x60x6 = 2160 connections for past 6 hours
// Attack source is non-distributed, triangulate by country level
// Feel free to adjust the assumption parameters to your environment needs

CommonSecurityLog
| where TimeGenerated >= ago (6h)
| where DestinationPort == "22"
| extend ip_location=geo_info_from_ip_address(SourceIP)
| extend Country=tostring(ip_location.country)
| where Country != ""
| summarize SSH_Connection=count() by Country 
| sort by SSH_Connection desc
| where SSH_Connection > 2160

// If analytics rule get triggered, this probably warrant a deeper investigation

// DefenderXDR Exposure Management for hashtag#RegreSSHion
// https://www.linkedin.com/posts/activity-7214788756237639680-rGkW/

//Use below KQL to determine your internet facing VM with OpenSSH and prioritize the following:
// - Access Control
// - Host-based Intrusion Prevention (E.g fail2ban)
// - SSH Configuration Hardening
// (E.g LoginGraceTime/MaxStartups/PerSourceMaxStartups)

// Refer to Splunk Mitigation Strategies for CVE-2024-6387
// Link: https://lnkd.in/gFPsbcaW

let InternetFacingVM=
ExposureGraphNodes
| where NodeLabel == 'device' or (Categories has 'virtual_machine' and set_has_element(Categories, 'virtual_machine'))
| where NodeProperties.rawData.isInternetFacing == true
| extend InternetFacingDeviceName=tostring(NodeProperties.rawData.deviceName)
| project InternetFacingDeviceName;
DeviceTvmSoftwareInventory
| where SoftwareName contains "openssh"
| where DeviceName has_any(InternetFacingVM)

"Timeout before authentication"
| regex("for (?<src_ip>\S+) port")
| groupBy([src_ip], function=count(as=timeouts))
| sort(timeouts, order=desc)

#alert ssh any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET INFO Server Responded with Vulnerable OpenSSH Version (CVE-2024-6387)"; flow:established,to_client; content:"SSH-"; startswith; content:"-OpenSSH_"; fast_pattern; pcre:"/^(?:[123]|4\.(?:[0123](?:p\d)?|4[^p])|8\.(?:[6789](?:p\d)?|5(?:p[^1])?)|9\.(?:[01234567](?:p\d)?|8[^p]))(?:\.\d)*(?:\d|p\d)*/R"; reference:cve,2024-6387; reference:url,blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server; classtype:successful-recon-largescale; sid:2054218; rev:2; metadata:attack_target Client_and_Server, created_at 2024_07_01, cve CVE_2024_6387, deployment Perimeter, deployment Internal, former_category EXPLOIT, performance_impact Significant, confidence High, signature_severity Informational, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_07_02, former_sid 2857461, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)