detection rulehost

dockerpwn managed ssh marker in sshd_config

Hostdockerpwn managed ssh marker in sshd_config

sudo grep -Rln 'dockerpwn managed ssh' /etc/ssh/ /etc/sshd_config /usr/local/etc/ssh/ 2>/dev/null

Posts using this rule

highSelf-Blocking Docker API Abuse Delivers the VoidLink DDoS-for-Hire Botnet
Host
The script leaves a fenced block of five managed directives bracketed by `# BEGIN dockerpwn managed ssh` / `# END`.
2026-06-10