← Back to SOC feed Coverage →

Custome SSH backdoor based on python and paramiko - file server.py

yara LOW Yara-Rules
backdoorcommunity
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-13T11:00:00Z · Confidence: medium

Hunt Hypothesis

The presence of a custom SSH backdoor using Python and Paramiko in the environment indicates potential adversary persistence and remote command execution capabilities. SOC teams should proactively hunt for this behavior to identify and mitigate stealthy, long-term access mechanisms that may evade traditional detection methods.

YARA Rule

rule custom_ssh_backdoor_server
{

    meta:
        description = "Custome SSH backdoor based on python and paramiko - file server.py"
        author = "Florian Roth"
        reference = "https://goo.gl/S46L3o"
        date = "2015-05-14"
        hash = "0953b6c2181249b94282ca5736471f85d80d41c9"

    strings:
        $s0 = "command= raw_input(\"Enter command: \").strip('n')" fullword ascii
        $s1 = "print '[-] (Failed to load moduli -- gex will be unsupported.)'" fullword ascii
        $s2 = "print '[-] Listen/bind/accept failed: ' + str(e)" fullword ascii
        $s3 = "chan.send(command)" fullword ascii
        $s4 = "print '[-] SSH negotiation failed.'" fullword ascii
        $s5 = "except paramiko.SSHException, x:" fullword ascii

    condition:
        filesize < 10KB and 5 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 6 string patterns in its detection logic.

References

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/MALW_BackdoorSSH.yar