Network Device CLI Commands via SSH Session

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to retrieve the running configuration of a network device via an SSH session. It specifically looks for the case-insensitive string "show running-config" in TCP traffic destined for port 22 (SSH) on the home network, indicating a potential administrative action or reconnaissance activity.