SSH: UNIX Post-Exploit Commands

This signature detects common commands sent in the clear (unencrypted). Attackers often use these commands to verify that they have successfully exploited an SSH vulnerability.

Extended Description

An attacker could send commands to gage the level of access granted and then begin using the compromised system.

References

URL: http://www.ietf.org/html.charters/OLD/secsh-charter.html

Short Name

SSH:MISC:EXPLOIT-CMDS-UNIX

Severity

Major

Recommended

False

Recommended Action

Drop

SSH: UNIX Post-Exploit Commands

Extended Description

References

Found a potential security threat?