This anomaly rule detects SSH connections where the client banner presented during the SSH handshake does not match a whitelist of common SSH clients. It leverages Zeek SSH logs (via the Splunk Zeek Add-on) to read the client banner from the handshake and filters out recognized clients (e.g., OpenSSH, PuTTY, Bitvise, FileZilla, Paramiko, etc.). Banners not in that whitelist are considered unusual and may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement. The rule ingests the zeek_ssh data, normalizes addressing fields (src, dest, dest_port), and aggregates results by unique src–dest–dest_port combinations, recording first/last seen times and the observed client banner(s). It emits an intermediate finding for each unusual session, including the source, destination, port, and the client banner, and includes macros to format timestamps. The detection is mapped to MITRE techniques T1021.004 (SSH) and T1572 (Protocol Tunneling), and supports investigation through related risk events and analytic stories focused on potential ingress and command-and-control activity. While effective, legitimate but uncommon SSH clients may trigger false positives, so tuning the known-banner whitelist is advised to reduce noise.