LoFP LoFP / legitimate but uncommon ssh client software not included will generate false positives. review the client banner and tune the filter accordingly.

Techniques

Sample rules

Unusual SSH Client Banner

Description

The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs. Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement.

Detection logic

`zeek_ssh`
client="*"
NOT client IN (
    "SSH-2.0-AsyncSSH*",
    "SSH-2.0-Bitvise*",
    "SSH-2.0-Cisco*",
    "SSH-2.0-CyberArk*",
    "SSH-2.0-dropbear*",
    "SSH-2.0-FileZilla*",
    "SSH-2.0-Go*",
    "SSH-2.0-JSCH*",
    "SSH-2.0-Juniper*",
    "SSH-2.0-libssh*",
    "SSH-2.0-MobaXterm*",
    "SSH-2.0-OpenSSH*",
    "SSH-2.0-paramiko*",
    "SSH-2.0-PuTTY*",
    "SSH-2.0-Renci.SshNet*",
    "SSH-2.0-SecureCRT*",
    "SSH-2.0-ssh2*",
    "SSH-2.0-TTSSH*",
    "SSH-2.0-WinSCP*",
    "SSH-2.0-Xshell*"
)


| eval dest_port=coalesce(dest_port, 'id.resp_p'),
       dest=coalesce(dest, dest_ip, 'id.resp_h'),
       src=coalesce(src, src_ip, 'id.orig_h')


| fillnull value=NULL


| stats count min(_time) as firstTime
              max(_time) as lastTime
              values(client) as client
              values(post_body) as post_body

  by src dest dest_port


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `unusual_ssh_client_banner_filter`