T1078: OpenSSH musl *sshole Password Login Followed by Root Escalation or Persis

Tim Peck@timpeck

•updated yesterday•7•0•35

Detects a successful sshd password login followed within 10 minutes on the same host by root escalation via doas/sudo, user creation, or authorized_keys modification by the same user. Targets post-exploitation of the OpenSSH musl/no-PAM password authentication bypass (*sshole, CVE-2026-123158).