A nested SSH session occurs when a user connects to one host using ssh, then subsequently connects to another system from that host.
Nested SSH sessions can be discovered by observing the timing of packets within SSH sessions.
Linux Persistence: atd
2025-04-01 DFIR CTF linux persistence at atd
Linux Persistence: SSH
2025-03-29 DFIR CTF SSH hardening hunting persistence linux persistence hunting hardening SSH PAM