[IA] - Suspicious SSH connection inspections

Sergio Albea@Sergio_Albea

•updated Jul 14, 2026•15•0•29

The aim of this query is detect SSH connections attempts where the external sources are specifying babeld (Network Protocol) or Conker (Network Conf. Manager) as parameters to establish a connection, is detect suspicious activity such as: Unauthorized SSH connections. Malicious use of SSH for lateral movement within a network. Exfiltration attempts via SSH tunneling.