Analytics
Informational
✕
Unusual SSH Activity
Unusual SSH activity was detected that involved a higher than usual volume of data transfer and an abnormally long session.
- Module:
- Platform Analytics
- Data source:
- Palo Alto Networks Firewall traffic Logs, XDR Agent
ATT&CK tactics: Command and Control (TA0011)
ATT&CK techniques: Protocol Tunneling (T1572)
Attacker's goals:
Attackers may use SSH or any similar utility to create a network tunnel to allow an attacker to covertly connect to an internal host.
Investigative actions:
Review the client IP/Agent for using known intelligence tools. Investigate the user accounts involved in the SSH connections to determine if credentials were compromised, Additionally examine logs for any unexpected data transfers or commands that may indicate malicious intent.
- Test period:
- 2 Hours
- Deduplication:
- 1 Day
2 variations:
- Unusual, long SSH activity with tunnel characteristics Low (parent: Informational)
- Unusual SSH activity with tunnel characteristics to external destination Low (parent: Informational)