NF – SSH connection established
this Snort rule is designed to detect SSH connections established from external networks to the internal network on the standard SSH port (port 22). If such a connection is established and occurs at least once within a 10-second window, the rule triggers an alert. The rule is crafted to identify SSH traffic based on the presence of the "SSH-" string in the payload.
ID Number
5024802
Signature
alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"NF - SSH connection established"; flow:to_server,established; detection_filter:track by_dst, count 1, seconds 10; content:"SSH-"; nocase; depth:4; reference:url,networkforensic.dk; metadata:24122017; classtype:misc-attack; sid:5024802; rev:1;)
MITRE ATT&CK Technique
-
Severity
High
Recommendations/Investigative actions
Identify the source and destination, call the POC (Point of contact) to check If the communication is authorized - close the event. If it's not configured - need to search for additional suspicious indicators - can be an attempt to perform lateral movement or malicious takeover.