SSH Version Scan

[Alexis <jakatsavras () gmail com>]

Is there a way for Snort to detect a SSH version scan made on port 22?

scan can be done either using "nmap -p 22 -sV 192.168.1.1" OR on Kali using
msf auxiliary(ssh_version)

I believe the below only works if the ssh scanner is scanssh.org

alert tcp $EXTERNAL_NET any -> $HOME_NET 22 (msg:"INDICATOR-SCAN SSH
Version map attempt"; flow:to_server,established; content:"Version_Mapper";
fast_pattern:only; metadata:ruleset community; classtype:network-scan;
sid:1638; rev:9;)

Thanks
alexis
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://sourceforge.net/mailarchive/forum.php?forum_name=snort-users

Please visit http://blog.snort.org to stay current on all the latest Snort news!