Operation Poisson: OpenSSH Server Installation on Windows Endpoint

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•7

This rule detects the installation and configuration of the OpenSSH Server feature on Windows endpoints. It monitors for the use of Add-WindowsCapability to install the feature, administrative commands (net.exe, sc.exe) used to manage the sshd service, and the creation or modification of authorized_keys files, which are often used to maintain persistent, passwordless access to the system.