Linux RC Script Modified for Persistence via SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects network traffic containing the string "/etc/rc" over SSH (port 22) to a server within the home network. This pattern suggests an attempt to modify an RC script for persistence on a Linux system, potentially by an attacker who has gained SSH access.