Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
1
1
Categories
1
1
1
1
Platforms
2
Products / Services
2
1
1
1
MITRE Techniques
1
1
1
1
1
IDS Classtypes
1
1
IDS Protocols
2,431
868
408
324
97
2
Detects established SSH network connections originating from the internal network to external destinations on ports other than the standard port 22. This behavior is often associated with unauthorized SSH tunneling or command-and-control (C2) communication intended to bypass standard firewall egress filtering.
SSH Brute Force Attempt Detected
Suricata
Detects repeated failed SSH authentication attempts which may indicate brute force activity against SSH services. The rule specifically looks for 8 SSH connection attempts to port 22 within a 60-second window from the same source IP.
