SOC147 EventID:94 —  SSH Scan Activity — letsdefend.io

SOC147 EventID:94 — SSH Scan Activity — letsdefend.io

EventID         :94
Event Time      :Jun, 13, 2021, 04:23 PM
Rule            :SOC147 - SSH Scan Activity
Level           :Security Analyst
Source Address  :172.16.20.5
Source Hostname :PentestMachine
File Name       :nmap
File Hash       :3361bf0051cc657ba90b46be53fe5b36
File Size       :2.82 MB
Device Action   :Allowed

Based on the provided incident report, it appears that a security alert was triggered which indicates a SSH scan activity. The alert specifies that the file “nmap”, which has a file hash of 3361bf0051cc657ba90b46be53fe5b36

It …

action address alert blue team hash incident letsdefendio name pentesting report scan security security alert size soc ssh