Shell Event Hook Script Written via SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to write shell event hook scripts, specifically those using 'trap' and 'SIGHUP', over an SSH connection. This activity is often associated with persistence mechanisms where an attacker sets up a script to execute upon certain shell signals, such as a hangup signal, to maintain access or execute malicious code.