Velvet Ant Trojanized OpenSSH Binary Replacement (sshd/ssh/scp)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects unauthorized write, modification, or creation events on critical SSH binary files (sshd, ssh, scp) on Linux systems. It excludes legitimate package management tools (e.g., apt, yum, dpkg, rpm) from triggering alerts to reduce noise from system updates.