VDSO Hijacking Payload Executed via SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•4

This rule detects the execution of a VDSO hijacking payload over an SSH connection. It specifically looks for the case-insensitive strings "vdso" and "mmap" within the TCP payload of an established SSH session, indicating an attempt to manipulate the Virtual Dynamic Shared Object (VDSO) for privilege escalation or other malicious purposes.