Velvet Ant - Trojanized OpenSSH Binary Replacement or Credential Harvesting

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects two suspicious behaviors related to OpenSSH. The first scenario identifies unauthorized modifications, creations, or renames of core OpenSSH binaries (/usr/sbin/sshd, /usr/bin/ssh, /usr/bin/scp) that are not initiated by common package managers, which could indicate persistence mechanisms or backdooring. The second scenario monitors ssh/sshd/scp processes creating or modifying files in common temporary or world-writable directories (/tmp, /var/tmp, /dev/shm, etc.), which is often indicative of credential harvesting or data staging.