Cross-source coverage
T1021.004 / ATT&CK
Remote Services: SSH
47 rules · 46 families across 7 sources.
4 deprecated hidden · include
From MITRE ATT&CK 19.2
Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.
SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via vim-cmd hostsvc/enable_ssh) or via vCenter. The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user (i.e., SSH Authorized Keys).
- Tactics
- Lateral Movement
- Platforms
- ESXi · Linux · macOS
- Telemetry
-
auditd:EXECVElinux:syslogNSM:Flowmacos:unifiedlogmacos:osqueryesxi:authesxi:shellesxi:vmkernel
How MITRE says to detect it DET0596
Behavioral Detection of Remote SSH Logins Followed by Post-Login Execution
Linux Analytic 1638
SSH login from a remote system (via sshd), followed by user context execution of suspicious binaries or privilege escalation behavior.
auditd:EXECVEEXECVElinux:syslogNoneNSM:FlowTCP port 22 traffic
macOS Analytic 1639
SSH login detected via Unified Logs, followed by unusual process execution, especially outside normal user behavior patterns.
macos:unifiedlogprocess = 'sshd'macos:unifiedlogprocess = 'ssh' OR eventMessage CONTAINS 'ssh'macos:osqueryprocess_events
ESXi Analytic 1640
SSH login via hostd or `/var/log/auth.log`, followed by CLI access to host shell or file manipulation in restricted areas.
esxi:authNoneesxi:shellNoneesxi:vmkernelport 22 access
elastic/detection-rules
20 rules| Detection | Severity | Format |
|---|---|---|
| AWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization | High | Elastic TOML |
| AWS EC2 Instance Connect SSH Public Key Uploaded | High | Elastic TOML |
| Potential Remote Desktop Tunneling Detected | High | Elastic TOML |
| Potential THC Tool Downloaded | High | Elastic TOML |
| Network Connection Initiated by Suspicious SSHD Child Process | Medium | Elastic TOML |
| Potential Execution via SSH Backdoor | Medium | Elastic TOML |
| Potential Internal Linux SSH Brute Force Detected | Medium | Elastic TOML |
| Remote File Creation in World Writeable Directory | Medium | Elastic TOML |
| Remote SSH Login Enabled via systemsetup Command | Medium | Elastic TOML |
| SSH Authorized Key File Activity Detected via Defend for Containers | Medium | Elastic TOML |
+ 10 more from elastic/detection-rules → showing the 10 highest-severity
splunk/security_content
9 rules| Detection | Severity | Format |
|---|---|---|
| Cisco IOS XE Remote Access Probe Burst | Undefined | SPL |
| Cisco Privileged Account Creation with HTTP Command Execution | Undefined | SPL |
| Cisco Privileged Account Creation with Suspicious SSH Activity | Undefined | SPL |
| Cisco Secure Firewall - SSH Connection to Non-Standard Port | Undefined | SPL |
| Cisco Secure Firewall - SSH Connection to sshd_operns | Undefined | SPL |
| ESXi SSH Enabled | Undefined | SPL |
| Linux SSH Remote Services Script Execute | Undefined | SPL |
| Windows Protocol Tunneling with Plink | Undefined | SPL |
| Windows PuTTY Suite Utility Execution | Undefined | SPL |
Wazuh Core Ruleset
7 rules · 6 families| Detection | Severity | Format |
|---|---|---|
| A file was copied to other system over SSH using pscp.exe | Medium | Wazuh XML |
| A file was copied to this system over SSH using SCP. | Medium | Wazuh XML |
| sshd: insecure connection attempt (scan). | Medium | Wazuh XML |
| Amazon Security Lake - VPC - SSH connection established. 2 variants | Low | Wazuh XML |
| Amazon Security Lake - VPC - SSH connection established. 2 variants | Low | Wazuh XML |
| sshd: Attempt to login using a non-existent user | Low | Wazuh XML |
| sshd: authentication failed. | Low | Wazuh XML |
SigmaHQ/sigma
5 rules| Detection | Severity | Format |
|---|---|---|
| Bitbucket Global SSH Settings Changed | Medium | Sigma |
| Bitbucket User Login Failure Via SSH | Medium | Sigma |
| OpenEDR Spawning Command Shell | Medium | Sigma |
| OpenSSH Server Listening On Socket | Medium | Sigma |
| Port Forwarding Activity Via SSH.EXE | Medium | Sigma |
elastic/protections-artifacts
3 rules| Detection | Severity | Format |
|---|---|---|
| Potential HackersChoice Tool Downloaded | Undefined | Elastic TOML |
| Sensitive File Access - SSH Saved Keys | Undefined | Elastic TOML |
| Unusual SSH Parent/Child Execution | Undefined | Elastic TOML |
panther-labs/panther-analysis
2 rules| Detection | Severity | Format |
|---|---|---|
| Wiz Issue WITH SSH to EC2 Instance | High | Panther Python |
| Signal - VPC Flow Logs Allowed SSH | Informational | Panther Python |
chainguard-dev/osquery-defense-kit
1 rule| Detection | Severity | Format |
|---|---|---|
| Find ssh sessions that are hiding from 'w'/'who' | Undefined | osquery SQL |