sshpass Credential Use with Host Key Validation Disabled
Detects the use of 'sshpass' to supply a password to SSH while simultaneously disabling strict host key checking. This combination is often indicative of automated lateral movement or credential stuffing attempts where an attacker is trying to bypass host key verification to connect to multiple systems without manual intervention.
Microsoft Sentinel (KQL)
