SSH: Malicious SSH Version

This signature detects multiple malicious SSH version strings that attackers can send while performing popular SSH exploits.

Extended Description

The presence of a malicious SSH version message string during the initial phase of an SSH connection could indicate that an exploit is being attempted.

References

URL: http://www.ietf.org/html.charters/OLD/secsh-charter.html

Short Name

SSH:MISC:MAL-VERSION

Severity

Major

Recommended

False

Recommended Action

Drop

SSH: Malicious SSH Version

Extended Description

References

Found a potential security threat?