SSH service publicly accessible

Classification:

attack

Tactic:

Technique:

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Goal

Detect when multiple external connections are made to the port for SSH (22).

Production hosts should not be publicly-accessible via SSH. Incoming connections from multiple public IP addresses indicate an exposed instance.

Review all events for connections from unexpected IP addresses.
Move the sshd service to a private network. If you must expose the host through SSH, restrict access with a security group.
Review login events and related signals for malicious activity.

This detection is based on data from Network Performance Monitoring.