Guest Diary: SANS ISC Intern Documents 22-Second SSH Compromise-to-Persistence Window

The SANS Internet Storm Center published a guest diary entry by Daryl Jiminez, an intern with the SANS.edu BACS program, examining how automated SSH threat actors move from initial login to establishing persistence in as little as 22 seconds. The diary is based on observed honeypot/SSH activity and details the speed at which scripted attackers act once credentials are compromised.

Why It Matters

This underscores a persistent reality for any internet-facing SSH service: brute-force and credential-stuffing bots are not manual, exploratory operations. They run scripted, automated playbooks that execute reconnaissance, backdoor installation, or persistence steps almost immediately after a successful login — leaving defenders with a very narrow window to detect and respond before an account compromise becomes a foothold. Organizations exposing SSH to the internet, using weak or reused credentials, or lacking rapid alerting on new logins are most at risk.

What Defenders Should Watch For

• Monitor for SSH authentication success events followed immediately (within seconds) by new user/key creation, cron job changes, or modification of authorized_keys files.
• Hunt for rapid command execution chains in shell history or auditd/session logs immediately after login, especially from source IPs with no prior legitimate access history.
• Review SSH exposure: restrict access via allow-lists, VPN, or bastion hosts, and disable password authentication in favor of key-based or MFA-backed access where possible.
• Consider tuning alerting thresholds to flag near-instantaneous post-login persistence actions rather than relying solely on failed-login/brute-force detection, since the diary highlights that the risk window begins at the moment of successful authentication.

This is a single guest diary report and reflects one intern researcher's observations rather than a broad industry advisory; details on specific tooling, IOCs, or targeted sectors were not provided in the summary available at publication. For the full technical writeup, see the original SANS ISC diary at isc.sans.edu/diary/rss/33220.