Skip to content

Latest commit

 

History

History
30 lines (26 loc) · 1.02 KB

WeakSSHVersionUsed.md

File metadata and controls

30 lines (26 loc) · 1.02 KB

Detect the usage of weak SSH sessions

Defender For Endpoint

DeviceNetworkEvents
| where ActionType == "NetworkSignatureInspected"
| extend
     SignatureName = tostring(parse_json(AdditionalFields).SignatureName),
     SignatureMatchedContent = tostring(parse_json(AdditionalFields).SignatureMatchedContent),
     SamplePacketContent = tostring(parse_json(AdditionalFields).SamplePacketContent)
| where SignatureName == "SSH"
| where SignatureMatchedContent == 'SSH-1'
| project-reorder Timestamp, DeviceName, RemoteIP, LocalIP

Sentinel

DeviceNetworkEvents
| where ActionType == "NetworkSignatureInspected"
| extend
     SignatureName = tostring(parse_json(AdditionalFields).SignatureName),
     SignatureMatchedContent = tostring(parse_json(AdditionalFields).SignatureMatchedContent),
     SamplePacketContent = tostring(parse_json(AdditionalFields).SamplePacketContent)
| where SignatureName == "SSH"
| where SignatureMatchedContent == 'SSH-1'
| project-reorder TimeGenerated, DeviceName, RemoteIP, LocalIP