CVE-2026-55200 libssh2 Pre-Auth RCE: PoC Artifacts and Exploit Harness Detection
This rule monitors for file creations and process executions associated with known proof-of-concept (PoC) artifacts for CVE-2026-55200 (a pre-authentication remote code execution vulnerability in libssh2). It also identifies suspicious child processes spawned from common SSH-related binaries, which may indicate successful exploitation or the execution of malicious payloads.
Microsoft Sentinel (KQL)
