SSH Login from Non-Internal IP
This rule detects successful SSH logins from external IP addresses. It specifically looks for syslog messages indicating "Accepted password" or "Accepted publickey" and then filters out connections originating from common private IP address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback addresses (127.0.0.0/8), and APIPA addresses (169.254.0.0/16). The rule extracts the username, source IP address, and source port of the successful login.
Splunk (SPL)
