SSH outbound to external IP

Jason Nelson@Jason

•updated Feb 16, 2026•8•0•215

This rule detects outbound SSH (Secure Shell) connections initiated by common SSH client executables (ssh.exe, ssh, plink.exe, dbclient.exe) to external IP addresses. It explicitly excludes connections to common private IP address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the loopback address (127.0.0.0/8) to reduce false positives from internal network activity.