Vendor: Linux

Product: SSH

Use-Case: Evasion

Rules	Models	MITRE TTPs	Event Types	Parsers
1	0	1	1	1

Event Type	Rules	Models
remote-logon	T1090.003 - Proxy: Multi-hop Proxy ↳ Auth-Tor-Shost: User authentication or login from a known TOR IP