fix to sshd rules

I don't know where the [preauth] comes from but I don't see it in my log messages and at least for the corrupted MAC messages I had to remove it so rule 1002 does not kick in.