How to avoid successful SSH Brute Force Attack

Question

Daily I receive alerts for "Successful SSH Brute Force Attack".

I have the active SSH service but in a another port than the default TCP/22.

I have Azure Firewall that protects my server at the network level.

The origin of SSH Brute Force attacks is an IP within the range assigned by Azure Firewall.

Attack events originate when users use the SSH service normally, but detects it as an attack.

Warning example:

Successful Ssh Brute Force Attack

Analysis of Host data has detected Successful Brute Force Attack. The IP 10.0.2.8 was Making Multiple Login Attempts. This means that the host may be committed and controlled by a malicious actor.

I request any recommendation to detect the origin of the problem and avoid the SSH attack.

Answer 1

Hi Simon Cifre , Thanks for posting your query on Microsoft Q&A.
Apologies for the delay as I was trying to figure the best course of action for your case.
Here are my recommendations:

One way to reduce exposure to an attack is to limit the amount of time that a port on your virtual machine is open. Ports only need to be open for a limited amount of time for you to perform management or maintenance tasks. Just-In-Time VM Access helps you control the time that the ports on your virtual machines are open. It leverages network security group (NSG) rules to enforce a secure configuration and access pattern.
Reference documents:

• https://azure.microsoft.com/en-us/blog/reduce-your-exposure-to-brute-force-attacks-from-the-virtual-machine-blade/
• https://learn.microsoft.com/en-us/azure/defender-for-cloud/just-in-time-access-usage

Secondly, here is a good article on Automation to Block Brute-force Attacked IP detected by Microsoft Defender for Cloud : https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/automation-to-block-brute-force-attacked-ip-detected-by/ba-p/1616825

Thirdly, please go through the Best practices for defending Azure Virtual Machines, shared by Microsoft Security Team: https://www.microsoft.com/en-us/security/blog/2020/10/07/best-practices-for-defending-azure-virtual-machines/

If there are further questions or you have already tried the suggestions shared above, please let me know in the "comments" and I can investigate further on this, over email with you.
Comments is the best way to share your questions/concerns as I will be notified immediately that way and can respond to you faster.

If this helped, 'Accept answer' so that it can help others in the community facing the same issue.