tag: Attack-Automation · 1 items
- Engineer — Learn: Research on automated SSH attack timelines underscores why key-only auth, login alerting, and session monitoring must be in place before an attacker lands — no specific patch needed, but validates hardening posture on any SSH-exposed host.
- SOC/IR — Plan: The ~22-second login-to-persistence window is a concrete benchmark: review SSH authentication alert latency in your SIEM and ensure post-login activity (new cron jobs, authorized_keys writes, shell spawns) triggers faster than that window closes.
- Leader — Skip