Renaming of OpenSSH Binaries

event.category:file and host.os.type:linux and event.type:change and 
process.name:(* and not (
  dnf or dnf-automatic or dpkg or yum or rpm or yum-cron or anacron or platform-python* or
  apk or ansible-admin or systemd or python* or yum or nix-daemon or nix
  )
) and 
(file.path:(/usr/bin/scp or 
              /usr/bin/sftp or 
              /usr/bin/ssh or 
              /usr/sbin/sshd) or 
file.name:libkeyutils.so) and
not (
  process.executable:(
    /usr/share/elasticsearch/* or "/usr/bin/microdnf" or "/usr/bin/dnf5" or "/usr/sbin/gdm" or
    "/usr/libexec/packagekitd" or "/usr/libexec/zypp/zypp-rpm" or "/home/sa-ansible"
  ) or
  file.Ext.original.name:"sshd.session-split"
)

False Positives

• ⚠ Trusted OpenSSH executable updates. It's recommended to verify the integrity of OpenSSH binary changes.