CVE-2026-55200 libssh2 RCE — libpwn harness and sshd post-exploit indicators
Detects indicators of exploitation attempts for the libssh2 pre-auth heap RCE vulnerability (CVE-2026-55200). The rule monitors for the execution of known harness binaries, abnormal child processes spawned by sshd, unauthorized file creation in sensitive temporary directories, and the loading of libssh2 libraries from non-standard, writable locations.
SentinelOne
