KQL Search

//Detect SSH traffic that isn't on port 22 connecting to public IP addresses

//Data connector required for this query - M365 Defender - Device* tables

//Microosft Sentinel query
DeviceNetworkEvents
| where ActionType == "NetworkSignatureInspected"
| extend AF = parse_json(AdditionalFields)
| extend NetworkSignature = AF.SignatureName
//Search for network signatures that are SSH but not on port 22
| where NetworkSignature == "SSH" and RemotePort != 22
//Exclude traffic where the remote IP is a private/local IP address, you can remove this if also interested in that traffic
| where not(ipv4_is_private(RemoteIP))
//Exclude traffic where the remote IP is a Link Local address
| where not(ipv4_is_match(RemoteIP,'169.0.0.0/8')) | project
    TimeGenerated,
    DeviceName,
    NetworkSignature,
    LocalIP,
    LocalPort,
    RemoteIP,
    RemotePort,
    RemoteUrl

//Advanced Hunting query

//Data connector required for this query - Advanced Hunting license

DeviceNetworkEvents
| where ActionType == "NetworkSignatureInspected"
| extend AF = parse_json(AdditionalFields)
| extend NetworkSignature = AF.SignatureName
//Search for network signatures that are SSH but not on port 22
| where NetworkSignature == "SSH" and RemotePort != 22
//Exclude traffic where the remote IP is a private/local IP address, you can remove this if also interested in that traffic
| where not(ipv4_is_private(RemoteIP))
//Exclude traffic where the remote IP is a Link Local address
| where not(ipv4_is_match(RemoteIP,'169.0.0.0/8')) 
| project
    Timestamp,
    DeviceName,
    NetworkSignature,
    LocalIP,
    LocalPort,
    RemoteIP,
    RemotePort,
    RemoteUrl