SSH Key Scraping by Node/Python

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•8

Detects attempts to access SSH private keys (id_rsa, id_ed25519) or public keys (.pub files) by 'node' or 'python' processes. This activity could indicate an attacker attempting to collect SSH credentials for lateral movement or persistence.