Python SSH Key Exfiltration from Code.exe or node.exe within 60s of File Access

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects Python scripts, launched by code.exe or node.exe (common IDE-related processes), accessing SSH private key files (id_rsa, id_ed25519, id_ecdsa) followed by an outbound network connection within 60 seconds. This behavior is indicative of credential theft and potential exfiltration or lateral movement.