Linux Proc Memory Injection via SSH Session

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•9

This rule detects potential memory injection attempts on Linux systems via an SSH session. It specifically looks for the strings "/proc/" and "/mem" within TCP traffic directed to an SSH server ($HOME_NET 22). This combination of strings suggests an attempt to access or manipulate process memory, which is a common technique used by attackers for privilege escalation or code injection.