High Fanout Internal SSH Connections from One Process

Daniel Jeremiah@daniyyell

•updated Jun 19, 2026•0•0•2

Detects a single process initiating SSH connections to a large number of distinct private IP addresses within a ten-minute window. This behavior can indicate automated lateral movement, credential spraying, or other malicious network reconnaissance activities.