lambsys SSH Private Key Harvesting and Lateral Movement from Langflow Hosts

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•1

Detects suspicious command-line execution patterns involving common SSH files and utilities, such as access to SSH keys, known_hosts, authorized_keys, or suspicious configuration flags. This pattern often indicates attempts to harvest SSH credentials, bypass host key checking, or facilitate persistent remote access. The rule specifically looks for these actions when performed by standard shell utilities or automated tools.