Automated SSH Lateral Movement via sshpass

Ibrahim Saud@tektrix

•updated Jun 22, 2026•3•0•15

This rule detects the use of 'sshpass' in conjunction with specific command-line arguments that indicate automated SSH logins. It specifically looks for the presence of '/sshpass/' and '/StrictHostKeyChecking=no/' in the command line, combined with common administrative account names like 'psoft', 'oracle', or 'linuxadm'. This activity is often associated with lateral movement techniques, as observed in attacks like those by ShinyHunters targeting Oracle/PeopleSoft environments.