Unusual SSH Client Banner

name: Unusual SSH Client Banner
id: 93d0f598-d65f-4c97-b030-5bb0af51a226
version: 1
creation_date: '2026-10-12'
modification_date: '2026-10-12'
author: Raven Tait, Splunk
status: production
type: Anomaly
description: |-
    The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs.
    Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement.
data_source:
    - Zeek SSH
search: |-
    `zeek_ssh`
    client="*"
    NOT client IN (
        "SSH-2.0-AsyncSSH*",
        "SSH-2.0-Bitvise*",
        "SSH-2.0-Cisco*",
        "SSH-2.0-CyberArk*",
        "SSH-2.0-dropbear*",
        "SSH-2.0-FileZilla*",
        "SSH-2.0-Go*",
        "SSH-2.0-JSCH*",
        "SSH-2.0-Juniper*",
        "SSH-2.0-libssh*",
        "SSH-2.0-MobaXterm*",
        "SSH-2.0-OpenSSH*",
        "SSH-2.0-paramiko*",
        "SSH-2.0-PuTTY*",
        "SSH-2.0-Renci.SshNet*",
        "SSH-2.0-SecureCRT*",
        "SSH-2.0-ssh2*",
        "SSH-2.0-TTSSH*",
        "SSH-2.0-WinSCP*",
        "SSH-2.0-Xshell*"
    )

    | eval dest_port=coalesce(dest_port, 'id.resp_p'),
           dest=coalesce(dest, dest_ip, 'id.resp_h'),
           src=coalesce(src, src_ip, 'id.orig_h')

    | fillnull value=NULL

    | stats count min(_time) as firstTime
                  max(_time) as lastTime
                  values(client) as client
                  values(post_body) as post_body

      by src dest dest_port

    | `security_content_ctime(firstTime)`
    | `security_content_ctime(lastTime)`
    | `unusual_ssh_client_banner_filter`
how_to_implement: |-
    Zeek SSH logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466).
    The client field should be populated from the SSH handshake banner.
    Configure the `zeek_ssh` macro to match the sourcetype used by your Zeek add-on.
known_false_positives: |-
    Legitimate but uncommon SSH client software not included will generate false positives.
    Review the client banner and tune the filter accordingly.
references:
    - https://docs.zeek.org/en/master/logs/ssh.html
    - https://attack.mitre.org/techniques/T1021/004/
    - https://attack.mitre.org/techniques/T1572/
drilldown_searches:
    - name: View the detection results for - "$src$"
      search: '%original_detection_search% | search src = "$src$"'
      earliest_offset: $info_min_time$
      latest_offset: $info_max_time$
    - name: View risk events for the last 7 days for - "$id.orig_h$"
      search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`'
      earliest_offset: 7d
      latest_offset: "0"
intermediate_findings:
    entities:
        - field: src
          type: system
          score: 20
          message: An unusual SSH client banner [$client$] was observed from [$src$] connecting to [$dest$] over port [$dest_port$].
threat_objects: []
analytic_story:
    - Ingress Tool Transfer
    - Command And Control
asset_type: Network
mitre_attack_id:
    - T1021.004
    - T1572
product:
    - Splunk Enterprise
    - Splunk Enterprise Security
    - Splunk Cloud
category: network
security_domain: network
tests:
    - name: True Positive Test
      attack_data:
        - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1572/zeek_ssh_unusual_client/ssh.log
          sourcetype: zeek:ssh
          source: ssh.log
      test_type: unit