VerdantBamboo MSP Credential Abuse - SSH/VPN Lateral Access to Edge Appliances

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects potentially malicious use of Managed Service Provider (MSP) credentials by correlating network or explicit authentication events (Logon Types 3, 9, or 10) occurring outside of typical business hours or originating from VPN/private network ranges, with concurrent SSH process activity on the same host. This pattern suggests an adversary may be using compromised credentials to move laterally or persist within an environment via SSH.