KeyDrift runit sshd run script hijack with conf_sshd/rsshd vdaemon injection
Detects unauthorized modifications to the runit SSH service run script or execution of loader processes and injectors referencing SD-WAN components (such as conf_sshd, rsshd, system-vdaemon, or libdssl.so) on Linux devices using Microsoft Defender for Endpoint telemetry.
Microsoft Sentinel (KQL)
