SSH Authentication from External IP Address
This rule detects successful SSH authentication attempts originating from IP addresses that are not classified as private (non-RFC1918). It specifically looks for log entries indicating 'Accepted password' or 'Accepted publickey' and then filters out source IP addresses that fall within common private IPv4 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16). The rule is designed to identify SSH access from external networks, which might be unusual in environments where SSH is expected to be primarily internal. It does not account for IPv6 private addresses.
Sigma
