KadNap Inbound SSH Blocking (iptables)

Bhojraj Joshi@cybrbhojrajjoshi

•updated May 1, 2026•1•0•185

Detects the use of iptables to drop incoming SSH traffic (port 22) on Linux, a behavior observed in KadNap botnet infections. This rule specifically looks for the execution of the `iptables` command with parameters to set an INPUT rule, specify TCP protocol, target destination port 22, and set the jump target to DROP.