Operation Poisson: OpenSSH Server Installation on Windows Workstation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•6

Detects unauthorized or suspicious installation and configuration of the OpenSSH server on Windows endpoints. This rule monitors for process creation of OpenSSH-related binaries, configuration of SSH services (e.g., via sc.exe, PowerShell, or winget), and modification of SSH-related configuration files and registry keys, which are often indicative of attackers establishing persistent backdoor access.