Anvilogic high experimental other

VPCFlow Accepted Inbound SSH [snowflake-vpcflow]

This use case monitors inbound ssh connections over vpc flows. -- Threat Actor Association: Sandworm (UAC-0165)

View Source

Detection Logic

select * from vpcflow where to_timestamp(date_part(epoch_second, start_time)) > $earliest$ and dest_port=22 and direction='ingress' and action='ACCEPT' and log_status!='NO DATA'

Field Validations

Loading…

Comments (0)

Loading comments...