Analytics BIOC Low
✕

Uncommon reverse SSH tunnel to external domain/ip

An uncommon reverse SSH tunnel might have been created.

Module:
Platform Analytics
Data source:
XDR Agent
ATT&CK tactics: Command and Control (TA0011)
ATT&CK techniques: Protocol Tunneling (T1572)
Detector tags: Abnormal Communication Analytics
Attacker's goals:

Attackers may use SSH to create an encrypted tunnel to allow an attacker to covertly connect to an internal host.

Investigative actions:

Review the external ip/domain. Investigate the causality of the process.

Test period:
N/A (single event)
Deduplication:
1 Day
3 variations:
  • Uncommon reverse SOCKS proxy SSH tunnel to external domain/ip Medium (parent: Low)
  • Uncommon reverse SSH tunnel to external domain/ip to a sensitive port via a non-default bind port Medium (parent: Low)
  • Uncommon reverse SSH tunnel to external domain/ip using a sensitive port Low