USB Drive Contents Copied via SSH SCP Session
This rule detects potential data exfiltration or unauthorized copying of data from USB drives via an SSH SCP session. It specifically looks for TCP traffic on port 22 (SSH) within the home network, where the data flow is from the client to the server (upload). The rule triggers if the content of the SCP session includes both "/media/" and "/usb" (case-insensitive), indicating paths commonly associated with mounted USB devices on Linux systems, and the data size is greater than 1000 bytes. This suggests that contents from a USB drive are being copied off the system over SSH.
Suricata
