Disallowed SSH Connection Non Standard Port

rule: Disallowed SSH Connection Non Standard Port
desc: 'Detect any new outbound SSH connection from the host or container using a non-standard
  port. This rule holds the potential to detect a family of reverse shells that cause
  the victim machine to connect back out over SSH, with STDIN piped from the SSH connection
  to a shell''s STDIN, and STDOUT of the shell piped back over SSH. Such an attack
  can be launched against any app that is vulnerable to command injection. The upstream
  rule only covers a limited selection of non-standard ports. We suggest adding more
  ports, potentially incorporating ranges based on your environment''s knowledge and
  custom SSH port configurations. This rule can complement the "Redirect STDOUT/STDIN
  to Network Connection in Container" or "Disallowed SSH Connection" rule.

  '
condition: 'outbound and proc.exe endswith ssh and fd.l4proto=tcp and ssh_non_standard_ports_network

  '
output: Disallowed SSH Connection | connection=%fd.name lport=%fd.lport rport=%fd.rport
  fd_type=%fd.type fd_proto=%fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid
  user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname
  command=%proc.cmdline terminal=%proc.tty
priority: NOTICE
tags:
- maturity_stable
- host
- container
- network
- process
- mitre_execution
- T1059