CVE-2026-55200 libssh2 RCE: Shell spawn within 60s of outbound SSH with listener escalation
This rule detects when a command-line shell (bash, sh, cmd, powershell) is spawned by a parent process (curl, git, php, ssh) that has recently established an outbound network connection on port 22 (SSH). It also flags instances where the child shell process subsequently opens a network listener, often indicating a potential reverse shell or unauthorized remote access attempt.
Splunk (SPL)
