Logging if someone jumps through the host

[jm23-23]

Hi,
I was looking for a tool that would help me log an event when someone uses the server as a proxy to connect to other hosts. It is commonly known that this is a typical vector of hacker activity, so the ability to log such events would be helpful in increasing server security. Unfortunately, apart from examples, I did not find any other triggers that could be used, and I checked that “connection_established” does not log sessions in which someone uses the server as a proxy (jumphost). Any hints?

[matthill]

I think if someone were to proxy through your SSH server, it should show up as an "ssh" command event. For example, seeing an ssh command shortly after connection establishment, or seeing the :ssh -W" command option would probably tell you when this is happening.