libssh2 Publickey List Heap Corruption PoC — Process Execution or Anomalous SSH Client Child (CVE-2026-55199/55200)
This rule detects the execution of known exploit binaries and proof-of-concept (PoC) tools associated with vulnerabilities in libssh2, as well as anomalous child process spawning from common SSH-related applications (curl, git, php). These behaviors are indicative of exploitation attempts or unauthorized activity related to the libssh2 exploit chain.
Cortex XDR
