System Shutdown Command Issued via Remote SSH

Darshan Thummar@Mighty

•updated Jun 12, 2026•0•0•3

This rule detects the execution of a system shutdown command ('shutdown -h now') over an SSH connection. It specifically looks for this string within TCP traffic directed to port 22 (SSH) on the home network, indicating a remote shutdown initiated via SSH.