Goal

Detect a resource connecting to many external hosts through SSH.

Strategy

Malware that brute forces SSH logins may act as a worm and use the compromised host to brute force other hosts. This can be identified by a large number of SSH connections to many different public IP addresses.

Triage and response

1. Review the destination IP addresses. Determine if the host is expected to make outbound SSH connections.
2. Review system authentication logs. Resources exhibiting this behavior are often compromised by SSH brute forcing.
3. Review Related Signals and relevant logs for additional malicious activity.
4. Repair the root cause of the compromise.

This detection is based on data from Network Performance Monitoring.