Inetutils Telnetd Post-Exploitation Activity
This rule detects post-exploitation activities originating from the `telnetd` process, specifically targeting scenarios following an Inetutils Telnetd authentication bypass. It identifies three main categories of malicious activity: reconnaissance, SSH key injection for persistence, and malware deployment. Reconnaissance activities are detected by commands like `uname -a`, `id`, `cat /proc/cpuinfo`, or `cat /etc/passwd` executed via common shells (`/bin/sh`, `/bin/bash`, `/bin/ash`). SSH key injection is identified by `echo` commands attempting to write SSH public keys (e.g., `ssh-rsa`, `ssh-ed25519`) into `~/.ssh/authorized_keys` or `/root/.ssh/authorized_keys`. Malware deployment is detected by `nohup` commands executing `curl` or `wget` to download and pipe content to interpreters like `python`, `python3`, `sh`, or `bash`.
Sigma
