Direct SSH Connection to Cloud VM via Serial Console
This rule detects direct SSH connections to cloud virtual machines (VMs) via a serial console interface. It specifically looks for HTTP traffic where the host header contains 'compute.googleapis.com' or 'cloudshell.googleapis.com' and the URI contains 'serialPort'. This indicates an attempt to establish an SSH session through the cloud provider's serial console service, which can be used for administrative access or lateral movement within a cloud environment.
Suricata
