ATT&CK T1592 - SSH Banner Grabbing

Darshan Thummar@Mighty

•updated Jun 10, 2026•1•0•4

This rule detects SSH banner grabbing attempts by monitoring TCP traffic to port 22 (SSH) on the home network. It specifically looks for the string "SSH-" within the first 4 bytes of the payload, indicating an attempt to identify the SSH server version. A threshold of 10 such events from the same source within 60 seconds will trigger an alert, classifying it as a network scan.