Linux System Logs Enumerated via Remote SSH

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•1

This rule detects attempts to enumerate Linux system logs via remote SSH connections. Specifically, it looks for the string "cat /var/log/" within TCP traffic on port 22 (SSH). A threshold of 10 occurrences within 30 seconds from the same source IP is set to reduce false positives.