Analytics BIOC Low
✕

Multiple uncommon SSH Servers with the same Server host key

Multiple uncommon SSH servers were observed using the same host key.

Module:
Platform Analytics
Data source:
Palo Alto Networks Firewall EAL Logs, XDR Agent
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Adversary-in-the-Middle (T1557)
Attacker's goals:

Attackers may attempt to move laterally within the network by exploiting and relaying stolen client credentials to another SSH server.

Investigative actions:

Audit the authentication attempts to the SSH server using the same key. Look for unusual or repeated connections from the same or unexpected hosts. Audit Client Credentials, check for any signs of compromised client credentials being used on different SSH servers.

Test period:
N/A (single event)
Deduplication:
1 Day