Afonso Duarte
@slytrimzCompletionist
0 followers1 download12 copies0 likes29 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
1
1
Platforms
2
1
1
1
Products / Services
1
1
MITRE Techniques
1
1
1
1
1
IDS Protocols
1
Detects execution of tunneling, proxy, and remote exposure tools associated with unauthorized access and protocol tunneling and web sockets.
This rule detects outbound SSH network connections (to ports 22, 2222) to external, non-private IP addresses.
It filters out internal IP addresses, local traffic, and allows for exclusions based on approved source processes, destination IPs, source hostnames, and destination domains.
It filters out internal IP addresses, local traffic, and allows for exclusions based on approved source processes, destination IPs, source hostnames, and destination domains.