An exec command in SSH is a single, non-interactive remote command that runs once and then exits. Instead of opening a shell for back-and-forth typing, the client asks the server to execute one instruction and close the session. This is common in automation, but it also matters in security because it leaves less behavioral evidence than an interactive login.
Attackers may prefer exec commands for quick checks, limited actions, or scripted follow-up after access is obtained. For defenders, that brevity is important: honeypots and logging systems that expect long sessions can miss useful signals if they only watch for repeated commands or visible exploration. Strong telemetry should separate authentication from command execution, capture the exact command when possible, and record timing and exit behavior. A short SSH session is not automatically malicious, but it can still be highly informative.