CVE-2026-55200 libssh2 Exploit Harness Execution or Artifact Creation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•13

This rule detects the presence and execution of files and scripts associated with the exploitation of CVE-2026-55200, such as harness binaries and proof-of-concept scripts. Additionally, it identifies post-exploitation behavior where common network-related processes (like curl, git, or sshd) spawn suspicious or unexpected child processes, which may indicate successful code execution or lateral movement originating from the compromised service.