PROTOCOLS: SSH Connection Over Non-Standard Port

This signature detects SSH connections over nonstandard ports. Some network devices support this as a standard feature, but attackers can also be using SSH on nonstandard ports as a method of firewall or IDS evasion. If this signature detects traffic destined to end-user workstations, you should take the appropriate security actions immediately.

Extended Description

If SSH traffic is detected on ports other than 22, this could indicate malicious activity. Attackers could use nonstandard ports with SSH to circumvent firewall restrictions, or hide backdoor SSH servers on compromised hosts.

Short Name

SSH:NON-STD-PORT

Severity

Warning

Recommended

False

Recommended Action

None

PROTOCOLS: SSH Connection Over Non-Standard Port

Extended Description

Found a potential security threat?