SSH Communications to External or Unauthorized Destinations

Afonso Duarte@slytrimz

•updated today•5•0•60

This rule detects outbound SSH network connections (to ports 22, 2222) to external, non-private IP addresses. It filters out internal IP addresses, local traffic, and allows for exclusions based on approved source processes, destination IPs, source hostnames, and destination domains.