Miasma Infostealer SSH Private Key Exfiltration via Node (T1552.004)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where a process not associated with standard SSH operations (e.g., ssh, scp, git) accesses SSH private key files, followed by an outbound network connection to a non-private IP address within a 5-minute window. This behavior is indicative of credential theft and subsequent exfiltration of sensitive SSH keys, often associated with infostealer malware.