Elastic high deprecated eql

Deprecated - SSH Connection Established Inside A Running Container

This rule detects an incoming SSH connection established inside a running container. Running an ssh daemon inside a container should be avoided and monitored closely if necessary. If an attacker gains valid credentials they can use it to gain initial access or establish persistence within a compromised environment.

View Source

Detection Logic

process where container.id: "*" and event.type == "start" and

/* use of sshd to enter a container*/
process.entry_leader.entry_meta.type: "sshd"  and

/* process is the initial process run in a container or start of a new session*/
(process.entry_leader.same_as_process== true or process.session_leader.same_as_process== true) and

/* interactive process*/
process.interactive== true

False Positives

⚠ SSH usage may be legitimate depending on the environment. Access patterns and follow-on activity should be analyzed to distinguish between authorized and potentially malicious behavior.

Field Validations

Loading…

Comments (0)

Loading comments...