Hades Stealer SSH Propagation Payload Detection

Ethan Andrews@eandrews

•updated Jun 8, 2026•1•0•5

Detects the creation or execution of the SSH propagation payload script (.sshu-setup.js), used by the Hades stealer to propagate via SSH from compromised workstations. This rule identifies file creation/modification/renaming events for the specific script name, or process creation events where the command line references the script.