Weak Cipher Negotiated in SSH Session

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the negotiation of a weak cipher, specifically 'arcfour', during an SSH session. It monitors TCP traffic flowing to the home network on port 22 (SSH) and triggers an alert if the string 'arcfour' is found in the established session, ignoring case.