Stitch-SDK - SSH Public Keys Mass Scrape (T1005)

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•1

Monitors the Node package manager engine performing mass file reads of all .pub files in the SSH keys path. This rule specifically looks for 'node.exe' accessing multiple files ending with '.pub' within folders containing '.ssh'.