SSH Agent Hijacking via Amazon Q MCP Subprocess - T1078.004

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

Detects anomalous activity associated with Amazon Q processes, including unauthorized access to SSH agent binaries, attempts to read SSH configuration files or keys in ~/.ssh/, and suspicious outbound network connections over port 22, potentially indicating lateral movement.