Login Script Modified on Remote Host via SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects attempts to modify login scripts, specifically '.profile', on a remote host via SSH. The detection is based on observing the string ".profile" within TCP traffic destined for port 22 (SSH) on the home network. This activity could indicate an attacker establishing persistence by modifying user login scripts to execute malicious commands upon subsequent logins.