SSH Session Hijacking via Agent Forwarding Abuse

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•4

This rule detects potential SSH session hijacking attempts that leverage agent forwarding abuse. It specifically looks for a byte sequence within the SSH traffic that could indicate such an attack. The rule targets TCP traffic on port 22 (SSH) flowing from the client to the server, ensuring the connection is established.