diff --git a/src/detection/terminalshell/terminalshell_linux.c b/src/detection/terminalshell/terminalshell_linux.c
index 61c05a82b..3a5449258 100644
--- a/src/detection/terminalshell/terminalshell_linux.c
+++ b/src/detection/terminalshell/terminalshell_linux.c
@@ -42,7 +42,6 @@ static pid_t getShellInfo(FFShellResult* result, pid_t pid)
                 ffStrbufEqualS(&result->processName, "sudo")                ||
                 ffStrbufEqualS(&result->processName, "su")                  ||
                 ffStrbufEqualS(&result->processName, "strace")              ||
-                ffStrbufEqualS(&result->processName, "sshd")                ||
                 ffStrbufEqualS(&result->processName, "gdb")                 ||
                 ffStrbufEqualS(&result->processName, "lldb")                ||
                 ffStrbufEqualS(&result->processName, "lldb-mi")             ||
@@ -102,7 +101,6 @@ static pid_t getTerminalInfo(FFTerminalResult* result, pid_t pid)
             ffStrbufEqualS(&result->processName, "oil.ovm")    ||
             ffStrbufEqualS(&result->processName, "xonsh")      || // works in Linux but not in macOS because kernel returns `Python` in this case
             ffStrbufEqualS(&result->processName, "login")      ||
-            ffStrbufEqualS(&result->processName, "sshd")       ||
             ffStrbufEqualS(&result->processName, "clifm")      || // https://github.com/leo-arch/clifm/issues/289
             ffStrbufEqualS(&result->processName, "chezmoi")    || // #762
             #ifdef __linux__
@@ -314,6 +312,8 @@ static void setTerminalInfoDetails(FFTerminalResult* result)
         ffStrbufInitStatic(&result->prettyName, "tmux");
     else if(ffStrbufStartsWithS(&result->processName, "screen-"))
         ffStrbufInitStatic(&result->prettyName, "screen");
+    else if(ffStrbufEqualS(&result->processName, "sshd") || ffStrbufStartsWithS(&result->processName, "sshd-"))
+        ffStrbufInitCopy(&result->prettyName, &result->tty);
 
     #if defined(__ANDROID__)
 
diff --git a/src/detection/terminalshell/terminalshell_windows.c b/src/detection/terminalshell/terminalshell_windows.c
index 4f8e02f57..f429ae81d 100644
--- a/src/detection/terminalshell/terminalshell_windows.c
+++ b/src/detection/terminalshell/terminalshell_windows.c
@@ -53,7 +53,6 @@ static uint32_t getShellInfo(FFShellResult* result, uint32_t pid)
         if(
             ffStrbufIgnCaseEqualS(&result->prettyName, "sudo")          ||
             ffStrbufIgnCaseEqualS(&result->prettyName, "su")            ||
-            ffStrbufIgnCaseEqualS(&result->prettyName, "sshd")          ||
             ffStrbufIgnCaseEqualS(&result->prettyName, "gdb")           ||
             ffStrbufIgnCaseEqualS(&result->prettyName, "lldb")          ||
             ffStrbufIgnCaseEqualS(&result->prettyName, "python")        || // python on windows generates shim executables
@@ -155,7 +154,7 @@ static bool getTerminalFromEnv(FFTerminalResult* result)
     }
 
     //SSH
-    if(getenv("SSH_CONNECTION") != NULL)
+    if(getenv("SSH_TTY") != NULL)
         term = getenv("SSH_TTY");
 
     //Windows Terminal
@@ -315,6 +314,11 @@ static void setTerminalInfoDetails(FFTerminalResult* result)
         ffStrbufSetStatic(&result->prettyName, "Windows Explorer");
     else if(ffStrbufEqualS(&result->prettyName, "wezterm-gui"))
         ffStrbufSetStatic(&result->prettyName, "WezTerm");
+    else if(ffStrbufIgnCaseEqualS(&result->prettyName, "sshd") || ffStrbufStartsWithIgnCaseS(&result->prettyName, "sshd-"))
+    {
+        const char* tty = getenv("SSH_TTY");
+        if (tty) ffStrbufSetS(tty);
+    }
 }
 
 bool fftsGetTerminalVersion(FFstrbuf* processName, FFstrbuf* exe, FFstrbuf* version);