title: Honeypot botnet family sshkey-830e (SSH key implant)
id: 9a6b084d-6e4b-5b67-a6ac-0dae43e8ce57
status: experimental
description: Command chain seen from 5 addresses in the https://ogurexxx.ru SSH honeypot
references:
    - https://ogurexxx.ru/live#sshkey-830e
author: ogurexxx.ru
date: 2026/10/28
tags:
    - attack.t1033
    - attack.t1053.003
    - attack.t1057
    - attack.t1059.004
    - attack.t1082
    - attack.t1083
    - attack.t1098
    - attack.t1098.004
    - attack.t1222.002
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        CommandLine|contains|all:
            - 'cd ~ && rm -rf .ssh && mkdir .ssh && echo'
            - 'cat /proc/cpuinfo | grep name | wc -l'
            - '| passwd | bash'
            - '| passwd'
            - 'cat /proc/cpuinfo | grep name | head -n 1 | awk'
            - 'free -m | grep'
            - 'ls -lh'
    condition: selection
falsepositives:
    - Administrators running the same commands in sequence
level: medium