Router Firmware Overwritten via SSH Session
This rule detects attempts to overwrite router firmware via an SSH session. It specifically looks for the string "flash write" within TCP traffic directed to port 22 (SSH) on the home network. This activity is indicative of an attacker attempting to modify the router's operating system, potentially for persistence, backdooring, or other malicious purposes.
Suricata
