Firmware or Bootkit Pushed via Remote SSH Session

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects attempts to push firmware or bootkit images to a device via a remote SSH session. It specifically looks for the commands 'dd if=' and '/dev/' within TCP traffic directed to port 22 (SSH), indicating an attempt to write data directly to a device file, which is a common method for flashing firmware or installing bootkits.