• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Linux Sshdinjector Backdoor Detection

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    ReversingLabs Yara@ReversingLabsYara
    •updated Mar 27, 2025•0•57

    This YARA rule detects the Sshdinjector backdoor on Linux systems. It identifies specific byte patterns associated with the backdoor's functionalities, including killing and restarting daemons, network communication, reading the /etc/shadow file (for credential dumping), and listing running services.

    YARA

    Tags

    S1027 - Heyoka BackdoorT1059 - Command and Scripting InterpreterT1021 - Remote ServicesT1071 - Application Layer ProtocolT1049 - System Network Connections DiscoveryT1003 - OS Credential DumpingTA0002 - ExecutionTA0008 - Lateral MovementTA0011 - Command and ControlTA0007 - DiscoveryTA0006 - Credential AccessMalware DetectedNetwork ConnectionCredential AccessCommand ExecutionLinux

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?