Tokyoneon remotely compromised the Active Directory server on the network. He is attempting to port scan the DNS server with nmaps `-sT` option to discover an SSH service. Complete the following Snort rule to detect Tokyoneons malicious activity (this instance). Be as specific as possible (use "any" sparingly, if at all).

alert ->

(msg:SSH activity detected!"; sid:2;)

pls. list step-by-step answer. thank you