Automated SSH Lateral Movement via sshpass

nomit vyas@xoxo

•updated Jun 25, 2026•1•0•9

Detects the use of 'sshpass' to automate SSH authentication, often used for lateral movement. The rule monitors command lines for the 'sshpass' utility combined with 'StrictHostKeyChecking=no' and specific service accounts (psoft, oracle, linuxadm) often targeted by threat actors such as ShinyHunters.