Spamming through SFTP connection

Sometimes spamming is done through SFTP connection. In such case you need to check spamming using the following steps:

1. Grep the ssh process and find out the process_id as follows:

================================
# ps -aux |grep ssh

xyz  17853  0.1  0.0  95048  2104 ?        S    18:08   0:08 sshd:
xyz@notty
root     17860  0.0  0.0   5892   700 ?        Ss   18:08   0:00 jailshell
(xyz) [17870] ell -c /usr/libexec/openssh/sftp-server
xyz  17870  0.0  0.0  53892  1992 ?        S    18:08   0:00
/usr/libexec/openssh/sftp-server
=================================

From the above result, you can see that an account xyz has established the
sftp access.

2. You now need to trace this process by:

=================================
strace  -p 17853
=================================

3. If you can see some process in this pid, execute the command given below:

=================================
strace -o output_log  -p 17853
=================================

You will now get a file output_log which contains the output of the processes
run under this pid.

4. If there is no process under this pid, check for the process which gets the
required data.

I am pasting the process of the pid of this sftp connection FYI:

=================================
rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
write(14, "RCPT TO:<abc@culpritdomain.net>"..., 34) = 34
read(18, "250 Accepted\r\n", 16384)     = 14
read(19, "250 Accepted\r\n", 16384)     = 14

rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
write(4, "Reply-To: <def@gmail.com"..., 35) = 35
read(9, "250 Accepted\r\n", 16384)      = 14
write(11, "RCPT TO:<ghi@somedomain.com.c"..., 36) = 36
write(12, "RCPT TO:<jkl@someotherdomain.com>\r\n", 32) = 32
read(13, "250 Accepted\r\n", 16384)     = 14
write(14, "RCPT TO:<mno@differentdomain.co"..., 36) = 3
=================================


5. Grep for the email address which is sending spam on the file  output_log. If
that process is the cause, it will show that particular email address.

Thank you.