ShinyHunters PeopleSoft - SSH Credential Spray & Lateral Movement

nomit vyas@xoxo

•updated Jun 24, 2026•1•0•11

Detects the specific ShinyHunters lateral movement pattern involving automated SSH credential spraying using 'sshpass' or rapid SSH connections to multiple hosts with PeopleSoft admin accounts, often after reading '/etc/hosts'. The rule identifies suspicious SSH activity by looking for 'sshpass' execution or multiple 'ssh' commands with specific PeopleSoft-related usernames, potentially preceded by commands to read '/etc/hosts'.