MSP Stolen Credential SSH Login — egnyteservice Account or Service Account via SSH

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•3

Detects unauthorized access and command execution associated with MSP service accounts. The rule triggers on successful SSH authentication using specific service account names (e.g., egnyteservice) followed by the execution of interactive shells under those same service account contexts, which is indicative of potential lateral movement or compromise in downstream environments.