Egress SSH scanning

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.


Detect a resource connecting to many external hosts through SSH.


Malware that brute forces SSH logins may act as a worm and use the compromised host to brute force other hosts. This can be identified by a large number of SSH connections to many different public IP addresses.

Triage and response

  1. Review the destination IP addresses. Determine if the host is expected to make outbound SSH connections.
  2. Review system authentication logs. Resources exhibiting this behavior are often compromised by SSH brute forcing.
  3. Review Related Signals and relevant logs for additional malicious activity.
  4. Repair the root cause of the compromise.

This detection is based on data from Network Performance Monitoring.