From 665c7ab5ee039d84f9527d7118633ae3647232b7 Mon Sep 17 00:00:00 2001
From: taylor_socfortress <111797488+taylorwalton@users.noreply.github.com>
Date: Tue, 23 Sep 2025 15:14:15 -0500
Subject: [PATCH] Add Beelzebub rule for SSH terminal interaction

---
 Beelzebub/100660-beelzebub.xml | 7 +++++++
 1 file changed, 7 insertions(+)
 create mode 100644 Beelzebub/100660-beelzebub.xml

diff --git a/Beelzebub/100660-beelzebub.xml b/Beelzebub/100660-beelzebub.xml
new file mode 100644
index 0000000..f68a5df
--- /dev/null
+++ b/Beelzebub/100660-beelzebub.xml
@@ -0,0 +1,7 @@
+<group name="beelzebub,">
+<rule id="100660" level="12">
+    <field name="event.Msg" type="pcre2">^SSH Terminal Session Interaction$</field>
+    <description>Honeypot SSH Terminal Session Interaction.</description>
+    <group>honeypot,ssh,</group>
+  </rule>
+</group>