Unix Shell Profile Modified for Persistence

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects network traffic containing the string ".bashrc" on TCP port 22 (SSH). This could indicate an attempt to modify a user's shell profile for persistence, as .bashrc is a common file used to configure the Bash shell environment and can be leveraged by attackers to execute malicious commands upon login.