Trojanized sshd writing captured passwords to fixed path

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•0

This rule detects either the execution of a specific SSH daemon binary known to be trojanized or the creation/modification of files within the /var/lib/sshd/ directory, which is a common indicator of backdoor persistence or credential theft targeting SSH sessions.