Outbound SSH Connection to Public IP from Private IP

Ankit Mehta@Secvyn

•updated Jun 29, 2026•3•0•1

This rule detects successful outbound SSH (port 22) connections originating from a private IP address on a device to a public IP address. This could indicate unauthorized remote access, data exfiltration, or command and control activity.