Credential Dump via Linux Proc Filesystem
This rule detects attempts to extract credentials from the Linux /proc filesystem over an SSH connection. Specifically, it looks for network traffic containing "/proc/", "/mem", and "ssh" (case-insensitive) within the same TCP flow to a server on port 22. This combination suggests an attacker might be trying to read sensitive memory regions or files related to SSH processes to dump credentials.
Suricata
