SSH Agent Forwarding Abuse - Lateral Movement

Darshan Thummar@Mighty

•updated Jun 10, 2026•0•0•4

This rule detects potential SSH agent forwarding abuse, which can be used for lateral movement within a network. It specifically looks for a byte sequence ('|00 00 00 1c 0b|') within TCP traffic on port 22 (SSH) flowing to the server, indicating an established connection. This byte sequence is characteristic of SSH agent forwarding requests.