[metadata]
creation_date = "2020/02/18"
maturity = "production"
updated_date = "2020/11/03"

[rule]
author = ["Elastic"]
description = """
This rule detects network events that may indicate the use of SSH traffic from the Internet. SSH is commonly used by
system administrators to remotely control a system using the command line shell. If it is exposed to the Internet, it
should be done with strong security controls as it is frequently targeted and exploited by threat actors as an initial
access or back-door vector.
"""
false_positives = [
    """
    Some network security policies allow SSH directly from the Internet but usage that is unfamiliar to server or
    network owners can be unexpected and suspicious. SSH services may be exposed directly to the Internet in some
    networks such as cloud environments. In such cases, only SSH gateways, bastions or jump servers may be expected
    expose SSH directly to the Internet and can be exempted from this rule. SSH may be required by some work-flows such
    as remote access and support for specialized software products and servers. Such work-flows are usually known and
    not unexpected.
    """,
]
index = ["filebeat-*", "packetbeat-*", "logs-endpoint.events.*"]
language = "kuery"
license = "Elastic License"
name = "SSH (Secure Shell) from the Internet"
risk_score = 47
rule_id = "ea0784f0-a4d7-4fea-ae86-4baaf27a6f17"
severity = "medium"
tags = ["Elastic", "Host", "Network", "Threat Detection", "Command and Control"]
type = "query"

query = '''
event.category:(network or network_traffic) and network.transport:tcp and (destination.port:22 or event.dataset:zeek.ssh) and
  not source.ip:(
    10.0.0.0/8 or
    127.0.0.0/8 or
    169.254.0.0/16 or
    172.16.0.0/12 or
    192.168.0.0/16 or
    224.0.0.0/4 or
    "::1" or
    "FE80::/10" or
    "FF00::/8"
  ) and
  destination.ip:(
    10.0.0.0/8 or
    172.16.0.0/12 or
    192.168.0.0/16
  )
'''


[[rule.threat]]
framework = "MITRE ATT&CK"

[rule.threat.tactic]
id = "TA0011"
name = "Command and Control"
reference = "https://attack.mitre.org/tactics/TA0011/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1021"
name = "Remote Services"
reference = "https://attack.mitre.org/techniques/T1021/"


[rule.threat.tactic]
id = "TA0008"
name = "Lateral Movement"
reference = "https://attack.mitre.org/tactics/TA0008/"
[[rule.threat]]
framework = "MITRE ATT&CK"
[[rule.threat.technique]]
id = "T1190"
name = "Exploit Public-Facing Application"
reference = "https://attack.mitre.org/techniques/T1190/"


[rule.threat.tactic]
id = "TA0001"
name = "Initial Access"
reference = "https://attack.mitre.org/tactics/TA0001/"

