From 7d13d93c86400ee62af48532bc1a42a6d0831a31 Mon Sep 17 00:00:00 2001
From: Alex 'AdUser' Z <ad_user@runbox.com>
Date: Mon, 9 Jan 2023 12:12:37 +1000
Subject: [PATCH] * filters/proftpd.preg

---
 filters/proftpd.preg | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/filters/proftpd.preg b/filters/proftpd.preg
index a6421ce..4aff490 100644
--- a/filters/proftpd.preg
+++ b/filters/proftpd.preg
@@ -1,7 +1,9 @@
 # set: defscore=30
 \(.*\[<HOST>\]\): SECURITY VIOLATION: Root login attempted
+\(.*\[<HOST>\]\): SECURITY VIOLATION: Passive connection from .* rejected
 # set: defscore=15
 \(.*\[<HOST>\]\): USER .*: no such user found
 \(.*\[<HOST>\]\): USER .* \(Login failed\): Incorrect password
 # set: defscore=1
 \(.*\[<HOST>\]\): FTP session opened
+\(.*\[<HOST>\]\): crypt\(3\) failed