Rule Info
Name
MAL_LNX_SSHHijack_Sep26
Author
Pezier Pierre-Henri
Description
Detects Linux binaries that attempt to hijack SSH sessions and steal credentials
Score
80
Reference
Internal Research
Date
2026-09-01
Minimum Yara
3.5.0
Rule Hash
004660f5b6b2b1eaca6afe897fbf1a78
Tags
['T1021_004', 'LINUX', 'MAL', 'FILE']
Required Modules
[]
Virustotal Matches
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
0
Suspicious (< 10 engines)
19
Clean (0 engines)
17
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR