All Detections

Void Dokkaebi - Ssh-add Key Exfiltration (T1552.004)

avatar
Ibrahim Saud@tektrix
updated Jun 21, 20261011

Identifies unauthorized attempts to leverage ssh-add or access the SSH agent socket to dump or forward local developer identities.

Microsoft Sentinel (KQL)