Lateral Movement - Agent SSH Pivot, Credential Transfer and Remote Agent Spawn

How the attack works

An AI agent's tool call runs a command that combines a lateral-movement action (scp, rsync, ssh-copy-id, sshpass, a network scan, or persistence setup) with a real remote target — a hostname or IP address, optionally with a username. Examples include archiving ~/.ssh, ~/.aws or ~/.kube and piping it to ssh/nc/curl, appending a key to a remote authorized_keys file, chaining an nmap/masscan sweep straight into an ssh/scp session, starting an agent runtime on a remote host over ssh, installing a cron/systemd/launchctl job remotely, reusing a password via sshpass, or opening a dynamic/reverse SSH tunnel. The rule only looks at the one command as written; it does not track what happened before or after.

Netzilo detection

Why it matters

An attacker who reaches one AI-agent host can use it as a jumping-off point to steal SSH keys or cloud credentials, plant persistent access on other machines, or pivot deeper into the network — turning a single compromised agent into a multi-host breach.

What you can do

• →Restrict AI agents' shell access so they cannot invoke scp, rsync, ssh, sshpass, or network scanners without explicit approval.
• →Keep credential directories (~/.ssh, ~/.aws, ~/.kube) out of reach of agent processes or store credentials in a vault instead of flat files.
• →Review any agent-run command that scans a network and then connects outward, or that touches remote authorized_keys, cron, systemd, or launchctl entries.
• →Maintain a list of approved provisioning/deployment jobs that legitimately use ssh-copy-id or rsync so real alerts aren't buried in routine ops noise.

Known benign look-alikes

• Platform/SRE agents running an approved provisioning job that uses ssh-copy-id the first time a new build host is enrolled.
• Deployment agents that rsync application configuration to a managed host and then run "systemctl enable" over ssh as part of a release.
• Authorized internal vulnerability-scanning workflows that pipe an nmap sweep into an ssh reachability check.
• Developer agents opening an ssh dynamic/reverse tunnel to reach a bastion-only service during debugging.
• An agent authoring a runbook, README or shell tutorial that contains example scp/ssh commands (mitigated by filter_docwrite and filter_placeholder).
• Help, version or man-page invocations of ssh/scp/rsync/nmap (mitigated by filter_help) and rsync dry runs (mitigated by filter_dryrun).

References

• https://attack.mitre.org/techniques/T1021/004/
• https://attack.mitre.org/techniques/T1570/
• https://attack.mitre.org/techniques/T1046/
• https://attack.mitre.org/techniques/T1563/001/

Related threats