[Snort-users] SSH Version Scan

Alexis jakatsavras at ...11827...
Wed Apr 12 09:20:37 EDT 2017


Is there a way for Snort to detect a SSH version scan made on port 22?

scan can be done either using "nmap -p 22 -sV 192.168.1.1" OR on Kali using
msf auxiliary(ssh_version)

I believe the below only works if the ssh scanner is scanssh.org

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"INDICATOR-SCAN SSH
Version map attempt"; flow:to_server,established; content:"Version_Mapper";
fast_pattern:only; metadata:ruleset community; classtype:network-scan;
sid:1638; rev:9;)

Thanks
alexis



More information about the Snort-users mailing list