ssh over ports apart from the traditional port 22 is highly uncommon. this rule alerts the usage of the such uncommon ports by the ssh service. tuning is needed to have higher confidence. if this activity is expected and noisy in your environment, consider adding exceptions — preferably with a combination whitelisted ports for such legitimate ssh activities.

t1571
cross-platform
elastic

Techniques

T1571

Sample rules

Potential Non-Standard Port SSH connection

source: elastic
technicques:
- T1571

Description

Identifies potentially malicious processes communicating via a port paring typically not associated with SSH. For example, SSH over port 2200 or port 2222 as opposed to the traditional port 22. Adversaries may make changes to the standard port a protocol uses to bypass filtering or muddle analysis/parsing of network data.

Detection logic

sequence by process.entity_id with maxspan=1m
  [process where event.action == "exec" and process.name:"ssh" and not process.parent.name in (
   "rsync", "pyznap", "git", "ansible-playbook", "scp", "pgbackrest", "git-lfs", "expect", "Sourcetree", "ssh-copy-id",
   "run"
   )
  ]
  [network where process.name:"ssh" and event.action in ("connection_attempted", "connection_accepted") and 
   destination.port != 22 and destination.ip != "127.0.0.1" and network.transport: "tcp"
  ]