From dab15ee505f6e5ee4e50363a78c6fb6ecb6a9ae1 Mon Sep 17 00:00:00 2001
From: Alex 'AdUser' Z <ad_user@runbox.com>
Date: Fri, 30 Dec 2022 16:15:37 +1000
Subject: [PATCH] + filters/proftpd.preg

---
 filters/proftpd.preg | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 filters/proftpd.preg

diff --git a/filters/proftpd.preg b/filters/proftpd.preg
new file mode 100644
index 0000000..a6421ce
--- /dev/null
+++ b/filters/proftpd.preg
@@ -0,0 +1,7 @@
+# set: defscore=30
+\(.*\[<HOST>\]\): SECURITY VIOLATION: Root login attempted
+# set: defscore=15
+\(.*\[<HOST>\]\): USER .*: no such user found
+\(.*\[<HOST>\]\): USER .* \(Login failed\): Incorrect password
+# set: defscore=1
+\(.*\[<HOST>\]\): FTP session opened