Obsidian Sandstorm SSH/RDP Lateral Movement via ssh.exe or plink.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects the use of legitimate SSH clients (ssh.exe, plink.exe) to initiate outbound network connections to internal IP ranges on port 22. This activity is consistent with Obsidian Sandstorm lateral movement tactics, where compromised credentials are used to establish SSH tunnels for internal network pivoting.