Rule History

alert ssh any any -> $EXTERNAL_NET any (msg:"🐾 - 🚨 Over 10MB uploaded via SSH / SFTP to public IP address - Possible data exfiltration 🚱"; requires: version >= 8; flow:to_server, established; threshold: type both, track by_src,count 1, seconds 60; flow.bytes_toserver:>=10000000; metadata:created_at 2024_02_18, updated_at 2024_06_04; sid:3301136; rev:5; classtype:policy-violation;)