SSH Agent Hijacking Followed by Remote Connection

Shadows VMB@Vemorian_Mort

•updated 12 days ago•7•0•11

Detects potential SSH agent hijacking where process command line activities reference SSH authentication sockets or environment variables, followed closely by a successful SSH connection to a remote host from the same device.