Uncommon reverse SSH tunnel to external domain/ip

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	XDR Agent
Detector Tags	Abnormal Communication Analytics
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Protocol Tunneling (T1572)
Severity	Low

Description

An uncommon reverse SSH tunnel might have been created.

Attacker's Goals

Attackers may use SSH to create an encrypted tunnel to allow an attacker to covertly connect to an internal host.

Investigative actions

• Review the external ip/domain.
• Investigate the causality of the process.

Variations

Uncommon reverse SOCKS proxy SSH tunnel to external domain/ip

Synopsis

Field	Value
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Protocol Tunneling (T1572)
Severity	Medium

Description

An uncommon reverse SSH tunnel might have been created.

Attacker's Goals

Attackers may use SSH to create an encrypted tunnel to allow an attacker to covertly connect to an internal host.

Investigative actions

• Review the external ip/domain.
• Investigate the causality of the process.

Uncommon reverse SSH tunnel to external domain/ip to a sensitive port via a non-default bind port

Synopsis

Field	Value
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Protocol Tunneling (T1572)
Severity	Medium

Description

An uncommon reverse SSH tunnel might have been created.

Attacker's Goals

Attackers may use SSH to create an encrypted tunnel to allow an attacker to covertly connect to an internal host.

Investigative actions

• Review the external ip/domain.
• Investigate the causality of the process.

Uncommon reverse SSH tunnel to external domain/ip using a sensitive port

Synopsis

Field	Value
ATT&CK Tactic	Command and Control (TA0011)
ATT&CK Technique	Protocol Tunneling (T1572)
Severity	Low

Description

An uncommon reverse SSH tunnel might have been created.

Attacker's Goals

Attackers may use SSH to create an encrypted tunnel to allow an attacker to covertly connect to an internal host.

Investigative actions

• Review the external ip/domain.
• Investigate the causality of the process.