diff --git a/config/filter.d/sshd.conf b/config/filter.d/sshd.conf
index fe46dd86..f3dd29f8 100644
--- a/config/filter.d/sshd.conf
+++ b/config/filter.d/sshd.conf
@@ -15,7 +15,8 @@
 # Values:  TEXT
 #
 failregex = (?:Authentication failure|Failed [-/\w+]+) for(?: [iI](?:llegal|nvalid))? user .*(?: from|FROM) <HOST>
-            ROOT LOGIN REFUSED .*(?: from|FROM) <HOST>
+            ROOT LOGIN REFUSED .* FROM <HOST>
+            [iI](?:llegal|nvalid) user .* from <HOST>
 
 # Option:  ignoreregex
 # Notes.:  regex to ignore. If this regex matches, the line is ignored.