| splunk |
Unusual SSH Client Banner |
production |
2026-10-12 |
| elastic |
Renaming of OpenSSH Binaries |
production |
2026-10-08 |
| elastic |
ESXi Host Prepared for an Unsigned Install |
production |
2026-09-30 |
| elastic |
ESXi SSH Session from vpxuser |
production |
2026-09-30 |
| elastic |
ESXi SSH Access Enabled |
production |
2026-09-30 |
| splunk |
AWS EC2 Multiple SSH Public Keys Uploaded by a Single Identity |
production |
2026-09-29 |
| elastic |
Successful SSH Authentication from Unusual User |
production |
2026-09-18 |
| elastic |
SSH Authorized Keys File Activity |
production |
2026-09-18 |
| elastic |
AWS EC2 Instance Connect SSH Public Key Uploaded |
production |
2026-09-18 |
| elastic |
AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization |
production |
2026-09-18 |
| elastic |
SSH Authorized Key File Activity Detected via Defend for Containers |
production |
2026-09-18 |
| elastic |
Linux SSH X11 Forwarding |
production |
2026-09-18 |
| elastic |
Potential Internal Linux SSH Brute Force Detected |
production |
2026-09-18 |
| elastic |
Successful SSH Authentication from Unusual SSH Public Key |
production |
2026-09-18 |
| elastic |
Successful SSH Authentication from Unusual IP Address |
production |
2026-09-18 |
| elastic |
Remote File Creation in World Writeable Directory |
production |
2026-09-18 |
| elastic |
Potential THC Tool Downloaded |
production |
2026-09-18 |
| elastic |
Unusual Remote File Creation |
production |
2026-09-18 |
| elastic |
SSH Key Generated via ssh-keygen |
production |
2026-09-18 |
| elastic |
Network Connection Initiated by Suspicious SSHD Child Process |
production |
2026-09-18 |
| elastic |
Potential Execution via SSH Backdoor |
production |
2026-09-18 |
| elastic |
Unusual SSHD Child Process |
production |
2026-09-18 |
| elastic |
Remote SSH Login Enabled via systemsetup Command |
production |
2026-09-18 |
| elastic |
Potential SSH Reverse Port Forwarding |
production |
2026-09-18 |
| elastic |
Potential Remote Desktop Tunneling Detected |
production |
2026-09-18 |
| splunk |
Cisco IOS XE Remote Access Probe Burst |
production |
2026-05-20 |
| splunk |
Cisco Secure Firewall - SSH Connection to sshd_operns |
production |
2026-05-13 |
| splunk |
Cisco Privileged Account Creation with Suspicious SSH Activity |
production |
2026-05-13 |
| splunk |
Cisco Secure Firewall - SSH Connection to Non-Standard Port |
production |
2026-05-13 |
| splunk |
ESXi SSH Enabled |
production |
2026-05-13 |
| splunk |
Linux SSH Remote Services Script Execute |
production |
2026-05-13 |
| splunk |
Windows Protocol Tunneling with Plink |
production |
2026-05-13 |
| splunk |
Windows PuTTY Suite Utility Execution |
production |
2026-05-13 |
| splunk |
Cisco Privileged Account Creation with HTTP Command Execution |
production |
2026-05-13 |
| sigma |
OpenEDR Spawning Command Shell |
experimental |
2026-02-19 |
| elastic |
Deprecated - SSH Process Launched From Inside A Container via Elastic Defend |
deprecated |
2026-02-04 |
| elastic |
Deprecated - SSH Connection Established Inside A Running Container |
deprecated |
2025-03-14 |
| elastic |
Deprecated - SSH Process Launched From Inside A Container |
deprecated |
2025-03-14 |
| sigma |
Port Forwarding Activity Via SSH.EXE |
test |
2024-03-05 |
| sigma |
Bitbucket User Login Failure Via SSH |
test |
2024-02-25 |
| sigma |
Bitbucket Global SSH Settings Changed |
test |
2024-02-25 |
| elastic |
Potential SSH Brute Force Detected on Privileged Account |
deprecated |
2023-06-22 |
| sigma |
OpenSSH Server Listening On Socket |
test |
2022-10-25 |