Network Device Firmware Downgraded via SSH
This rule detects attempts to downgrade network device firmware via SSH by looking for the string "boot system flash" in TCP traffic directed to port 22 (SSH). This command is commonly used on Cisco IOS devices to specify the system image to boot from, and its presence in an SSH session could indicate an attempt to revert to an older, potentially vulnerable firmware version or to a malicious image.
Suricata
