Analytics BIOC Low
✕

Rare SSH Session

Secure Shell (SSH) provides a secure means of remote administration. Attackers can use valid SSH credentials and keys to remotely connect to endpoints running the SSH service.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Lateral Movement (TA0008)
ATT&CK techniques: Remote Services (T1021)
Attacker's goals:

Secure Shell (SSH) provides a secure means of remote administration. Attackers can use valid SSH credentials and keys to remotely connect to endpoints running the SSH service.

Investigative actions:

Verify that the process is allowed in the organization. Check if the user should access the destination and whether the session was successful or not.

Test period:
N/A (single event)
Deduplication:
1 Hour