Synopsis
Activation Period |
14 Days |
Training Period |
30 Days |
Test Period |
N/A (single event) |
Deduplication Period |
1 Day |
Required Data |
|
Detection Modules |
|
Detector Tags |
Abnormal Communication Analytics |
ATT&CK Tactic |
|
ATT&CK Technique |
|
Severity |
Low |
Description
An uncommon reverse SSH tunnel might have been created.
Attacker's Goals
Attackers may use SSH to create an encrypted tunnel to allow an attacker to covertly connect to an internal host.
Investigative actions
- Review the external ip/domain.
- Investigate the causality of the process.