Hunt: unusually long or all-"A" SSH passwords in front of internet-exposed sshd (SSHole)

hunt idea based on SANS ISC honeypot observations (Nov 8); not a vendor-published detection2026-11-08

Where it applies: honeypots (Cowrie and similar), SSH proxies or bastions that record auth attempts. Stock sshd does not log the attempted password, so do not expect to find this in auth.log.
Query ideas: auth attempts whose password is far longer than your normal brute-force wordlists (ISC's honeypots truncate at 255 characters); passwords made of one repeated character such as all "A"; shell commands pasted into a password field (a separate pattern ISC saw, often wget/curl followed by chmod).
Host-side follow-up on exposed Linux hosts: sshd crashes or restarts around inbound connections, then new root sessions or unexpected processes started by sshd. See our earlier SSHole hunt and patch items for the Alpine/OpenSSH 10.6p2 details.
Caveat: ISC says some long "passwords" were buggy scripts rather than exploits, so treat a hit as a lead to check, not proof of compromise.