ShinyHunters PeopleSoft - SSH Credential Spray & Lateral Movement

Lacey Cochrane@NullVectorX

•updated Jun 11, 2026•8•0•14

Detects the specific ShinyHunters lateral movement pattern involving automated SSH credential spraying using 'sshpass' or rapid SSH connections to multiple hosts with PeopleSoft admin accounts, often after reading '/etc/hosts' for target identification. The rule looks for multiple SSH connections within a 10-minute window from a single host and user, specifically targeting common PeopleSoft-related usernames.