Rule Info
Name
MAL_LNX_SSHHijack_Sep26
Author
Pezier Pierre-Henri
Description
Detects Linux binaries that attempt to hijack SSH sessions and steal credentials
Score
80
Reference
Internal Research
Date
2026-09-01
Minimum Yara
3.5.0
Rule Hash
004660f5b6b2b1eaca6afe897fbf1a78
Tags
['T1021_004', 'LINUX', 'MAL', 'FILE']
Required Modules
[]
Virustotal Matches
Antivirus Verdicts
Rating
Number of Samples
Malicious (>= 10 engines)
0
Suspicious (< 10 engines)
8
Clean (0 engines)
3
Rule Matches
Timestamp
Positives
Total
Hash
VT
Rule Matches per Month (last 24 months)
Scan your endpoints, forensic images or collected files with our portable scanner THOR