OpenSSH Server Backdoor Installation on Non-SSH Workstation (Operation Poisson)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the installation or initiation of an OpenSSH server (sshd) process, which may indicate an attacker establishing a persistent, redundant remote access backdoor. The rule monitors for common installation/enablement patterns across Windows (via sc.exe, PowerShell WindowsCapability) and Linux (via systemctl, service) and flags instances running from non-standard or temporary directories.