SSH Private Key File Exposed on Web Server

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects attempts to access SSH private key files (id_rsa, id_dsa, id_ecdsa, or .pem files) via HTTP. It specifically looks for these file extensions or names in the HTTP URI, indicating a potential exposure of sensitive SSH credentials on a web server.