Automated SSH Lateral Movement (UNC6240 / ShinyHunters)
Detects the use of sshpass combined with disabled strict host key checking. This pattern matches the propagation scripts used by UNC6240 for rapid lateral movement across internal nodes following Oracle PeopleSoft exploitation.
Microsoft Sentinel (KQL)
