Systemctl Service Enabled via Remote SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•7

This rule detects the string "systemctl enable" within TCP traffic on port 22 (SSH). This indicates an attempt to enable a systemd service on a remote Linux host via an established SSH connection. This activity could be part of legitimate system administration but also could be indicative of an attacker persisting a malicious service.