Shell History Grepped for Passwords via SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•6

This rule detects attempts to grep for passwords within the bash history file over an SSH connection. Specifically, it looks for the string 'grep -i password ~/.bash_history' in TCP traffic destined for port 22 (SSH). This activity is indicative of an attacker attempting to discover credentials on a compromised system.