Rule History

alert ssh any any -> $EXTERNAL_NET any (msg:"🐾 - 🚨 Over 100MB uploaded via SSH / SFTP to public IP address - Possible data exfiltration 🚱"; requires: version >= 8; flow:to_server, established; threshold: type both, track by_src,count 1, seconds 60; flow.bytes_toserver:>=100000000; metadata:created_at 2024_02_18, updated_at 2024_06_04; sid:3301137; rev:4; classtype:policy-violation;)