[Snort-users] SSH Version Scan

Alexis jakatsavras at ...11827...
Wed Apr 12 09:20:37 EDT 2017

Is there a way for Snort to detect a SSH version scan made on port 22?

scan can be done either using "nmap -p 22 -sV" OR on Kali using
msf auxiliary(ssh_version)

I believe the below only works if the ssh scanner is scanssh.org

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"INDICATOR-SCAN SSH
Version map attempt"; flow:to_server,established; content:"Version_Mapper";
fast_pattern:only; metadata:ruleset community; classtype:network-scan;
sid:1638; rev:9;)


More information about the Snort-users mailing list