title: Honeypot botnet family sshkey-b6c8 (SSH key implant)
id: 81fc78c6-33d5-5b5a-a079-60e792aab177
status: experimental
description: Command chain seen from 4 addresses in the https://ogurexxx.ru SSH honeypot
references:
    - https://ogurexxx.ru/live#sshkey-b6c8
author: ogurexxx.ru
date: 2026/10/29
tags:
    - attack.t1033
    - attack.t1053.003
    - attack.t1057
    - attack.t1059.004
    - attack.t1082
    - attack.t1083
    - attack.t1098
    - attack.t1098.004
    - attack.t1222.002
    - attack.t1489
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        CommandLine|contains|all:
            - 'cd ~ && rm -rf .ssh && mkdir .ssh && echo'
            - 'cat /proc/cpuinfo | grep name | wc -l'
            - '| chpasswd | bash'
            - 'rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.'
            - 'cat /proc/cpuinfo | grep name | head -n 1 | awk'
            - 'free -m | grep'
            - 'ls -lh'
    condition: selection
falsepositives:
    - Administrators running the same commands in sequence
level: medium