lambsys SSH Key Harvesting and Lateral Movement via Cryptominer Worm

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

This rule detects suspicious activities related to SSH credential theft and lateral movement on Linux systems. It monitors for interactive shells or utilities like cat, python, and bash accessing common SSH configuration files (~/.ssh/id_rsa, authorized_keys, etc.), as well as automated SSH/SCP sessions using suspicious configurations (BatchMode=yes, StrictHostKeyChecking=no) or specific malicious payloads.