Password Protected Zip Created for Exfil via SSH

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects the string "zip -e" within TCP traffic on port 22 (SSH). This string is commonly used to create password-protected zip archives, and its presence in an SSH session could indicate an attempt to prepare data for exfiltration, especially if combined with SSH's secure tunneling capabilities. The rule specifically looks for traffic flowing from the client to the server.