lambsys SSH key theft followed by multi-host lateral movement worm behavior

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

Detects a sequence of suspicious activities characteristic of an SSH-based worm. The rule correlates non-standard processes reading SSH private keys, the presence of known cryptominer components (lambsys, procq, isp.sh), and subsequent SSH network fan-out activity from the same host, indicating lateral movement.