CVE-2026-55200 libssh2 Pre-Auth RCE - Unexpected Child Process After Outbound SSH
Detects potential remote code execution (RCE) via CVE-2026-55200 in libssh2-linked applications. The rule monitors for two signals: firstly, a post-exploitation child process (such as a shell or interpreter) spawned by a common libssh2-reliant application (e.g., ssh, curl, git, php) shortly after an outbound connection to TCP ports 22 or 2222; secondly, anomalous outbound network connections to port 2222 originating from these same libssh2-linked binaries.
Microsoft Sentinel (KQL)
