VerdantBamboo SSH Lateral Movement from Compromised Edge Appliances (BRICKSTORM)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•5

This rule detects two potentially malicious activities related to SSH: first, specific utilities (e.g., luserput, blacklist, ssh) initiating outbound connections to internal network CIDR ranges over port 22, which may indicate lateral movement; second, the creation or modification of the .ssh/authorized_keys file, which is a common technique for establishing persistence or unauthorized access.