Velvet Ant Trojanized OpenSSH Binary Modification or Credential Logging

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects two suspicious behaviors associated with OpenSSH components: the direct modification or replacement of critical OpenSSH binaries (/usr/sbin/sshd, /usr/bin/ssh, /usr/bin/scp), or the use of these processes to write files to suspicious or non-standard locations (such as /tmp/ or unauthorized subdirectories within /var/log/), which may indicate credential harvesting or the presence of a backdoor.