Add SSH brute force detection rule

[LB89-code]

Summary of the Pull Request

This PR adds a new Sigma rule for detecting repeated SSH authentication failures on Linux systems.
The rule identifies potential brute-force activity based on multiple failed login attempts from the same source.

Changelog

new: Add SSH Multiple Authentication Failures detection rule

Example Log Event

{
"timestamp": "2025-12-03T10:15:22Z",
"host": "ubuntu-server",
"process": "sshd",
"event": "Failed password",
"source_ip": "192.168.1.50",
"username": "root"
}

Fixed Issues

N/A – new rule, no fixes included.

SigmaHQ Rule Creation Conventions

This rule follows SigmaHQ conventions, uses valid ATT&CK tags, modern condition syntax, and a UUID-based rule identifier.

• If your PR adds new rules, please consider following and applying these conventions

[nasbench]

Please keep your rule up to standard by reading the conventions linked in the PR summary as well as the specs. Or else this PR will be closed

[LB89-code]

Thanks for the review! I've updated the rule according to the Sigma conventions. Please let me know if you’d like any further adjustments.