Automated SSH Lateral Movement via sshpass

nomit vyas@xoxo

•updated Jun 25, 2026•1•0•11

Detects the use of 'sshpass' with disabled host key checking ('StrictHostKeyChecking=no') to automate SSH connections. The rule specifically targets command lines referencing administrative accounts ('psoft', 'oracle', 'linuxadm'), a technique associated with ShinyHunters lateral movement activity.