VerdantBamboo BRICKSTORM - Lateral SSH from Internal Edge Appliance to Internal Host

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects unusual internal SSH connections between private IP addresses that are not initiated by common, trusted administrative tools (like ssh.exe, putty.exe, etc.). The rule aggregates these connections by source and host to identify potential lateral movement.