I know, still most of the script kiddy attacks I see (on a honeypot ssh for ex) are of the 'wget download bad script' type. I typically uninstall gcc and my scr

I know, still most of the script kiddy attacks I see (on a honeypot ssh for ex) are of the 'wget download bad script' type. I typically uninstall gcc and my scripts don't use wget/curl/scp, now rsync otoh... can't blacklist all possible tools, you may as well netfilter traffic to block non-root initiated traffic going out.