Infostealer: Unexpected Process Accessing SSH Private Key Files

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•1

This rule detects file-related events (creation, modification, deletion, or renaming) targeting common SSH private key files (id_rsa, id_ed25519, id_ecdsa) and host keys. It filters out expected processes like standard SSH clients and key generation tools, flagging potential unauthorized access or credential harvesting by other applications.