New System Service Registered via Remote SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to register a new system service via a remote SSH connection. It specifically looks for the string "service install" within TCP traffic on port 22 (SSH) flowing from a client to a server within the home network. This activity could indicate an attacker establishing persistence on a compromised system.