Network Device Running Config Copied via SSH

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•5

This rule detects attempts to copy the running configuration from a network device via SSH. It specifically looks for the string "show running-config" within TCP traffic destined for port 22 (SSH) on the home network. This activity is often associated with reconnaissance or data exfiltration by attackers or malicious insiders.