PATH Environment Variable Hijack via SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to hijack the PATH environment variable during an SSH session. It specifically looks for the string "export PATH=" within TCP traffic on port 22 (SSH), indicating a potential malicious modification of the PATH environment variable to control command execution paths.