ZD POLICY SSH outbound on non-standard port - possible tunnel or C2

Ali AlEnezi@site

•updated Sep 15, 2026•1•0•3

Detects established SSH network connections originating from the internal network to external destinations on ports other than the standard port 22. This behavior is often associated with unauthorized SSH tunneling or command-and-control (C2) communication intended to bypass standard firewall egress filtering.