Detection: Unusual SSH Client Banner

Created: 2026-10-12 Last Updated: 2026-10-12 ID: 93d0f598-d65f-4c97-b030-5bb0af51a226 Author: Raven Tait, Splunk Type: Anomaly Product: Splunk Enterprise Security

Description

The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs. Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement.

Search

 1`zeek_ssh`
 2client="*"
 3NOT client IN (
 4    "SSH-2.0-AsyncSSH*",
 5    "SSH-2.0-Bitvise*",
 6    "SSH-2.0-Cisco*",
 7    "SSH-2.0-CyberArk*",
 8    "SSH-2.0-dropbear*",
 9    "SSH-2.0-FileZilla*",
10    "SSH-2.0-Go*",
11    "SSH-2.0-JSCH*",
12    "SSH-2.0-Juniper*",
13    "SSH-2.0-libssh*",
14    "SSH-2.0-MobaXterm*",
15    "SSH-2.0-OpenSSH*",
16    "SSH-2.0-paramiko*",
17    "SSH-2.0-PuTTY*",
18    "SSH-2.0-Renci.SshNet*",
19    "SSH-2.0-SecureCRT*",
20    "SSH-2.0-ssh2*",
21    "SSH-2.0-TTSSH*",
22    "SSH-2.0-WinSCP*",
23    "SSH-2.0-Xshell*"
24)
25
26
27| eval dest_port=coalesce(dest_port, 'id.resp_p'),
28       dest=coalesce(dest, dest_ip, 'id.resp_h'),
29       src=coalesce(src, src_ip, 'id.orig_h')
30
31
32| fillnull value=NULL
33
34
35| stats count min(_time) as firstTime
36              max(_time) as lastTime
37              values(client) as client
38              values(post_body) as post_body
39
40  by src dest dest_port
41
42
43| `security_content_ctime(firstTime)`
44
45| `security_content_ctime(lastTime)`
46
47| `unusual_ssh_client_banner_filter`

Data Source

Name	Platform	Sourcetype	Source
Zeek SSH	Network	`'zeek:ssh'`	`'ssh.log'`

Macros Used

Name	Value
zeek_ssh	`sourcetype="zeek:ssh"`
unusual_ssh_client_banner_filter	`search *`

unusual_ssh_client_banner_filter is an empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Annotations

- MITRE ATT&CK

+ Kill Chain Phases

+ NIST

+ CIS

- Threat Actors

ID	Technique	Tactic
T1021.004	SSH	Lateral Movement
T1572	Protocol Tunneling	Command and Control

Command and Control

Exploitation

DE.AE

CIS 13

Default Configuration

This detection is configured by default in Splunk Enterprise Security to run with the following settings:

Setting	Value
Disabled	true
Cron Schedule	`0 * * * *`
Earliest Time	`-70m@m`
Latest Time	`-10m@m`
Schedule Window	`auto`
Creates Finding (Notable)	No
Creates Intermediate Finding (Risk Event)	Yes

Anomaly detections generate Intermediate Findings (Risk Events). They do not generate a Finding (Notable) directly.

Implementation

Zeek SSH logs must be ingested into Splunk using the latest version of Splunk Add-on for Zeek (https://splunkbase.splunk.com/app/5466). The client field should be populated from the SSH handshake banner. Configure the zeek_ssh macro to match the sourcetype used by your Zeek add-on.

Known False Positives

Legitimate but uncommon SSH client software not included will generate false positives. Review the client banner and tune the filter accordingly.

Associated Analytic Story

Intermediate Findings

Message	Entity Field	Entity Type	Risk Score
An unusual SSH client banner [$client$] was observed from [$src$] connecting to [$dest$] over port [$dest_port$].	src	system	20

References

Detection Testing

Test Type	Status	Dataset	Source	Sourcetype
Validation	✅ Passing	N/A	N/A	N/A
Unit	✅ Passing	Dataset	`ssh.log`	`zeek:ssh`
Integration	✅ Passing	Dataset	`ssh.log`	`zeek:ssh`

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

Source: GitHub |

Version: 1