Automated Input Injection via SSH Session
This rule detects the string "xdotool" within an SSH session (port 22) traffic flowing from the client to the server. xdotool is a command-line tool that simulates keyboard input and mouse activity, often used for automated input injection. Detection of this string suggests an attempt to automate actions within an SSH session, which could be indicative of malicious activity such as automated command execution or data exfiltration.
Suricata
