Sigma Rules

Potential Exploitation of CVE-2024-3094 - Suspicious SSH Child Process

Detects potentially suspicious child process of SSH process (sshd) with a specific execution user. This could be a sign of potential exploitation of CVE-2024-3094.