OpenSSH

Event	Title	Channel	Sample	Rule
1	process: payload.	Admin	N	N
2	process: payload.	Admin	Y	N
3	process: payload.	Operational	N	N
4	process: payload.	Operational	Y	Y
6	process: payload.	Debug	N	N

Event ID 1: process: payload.

Channel: Admin

Message #

%1: %2

Fields #

Name	Description
`process` UnicodeString
`payload` UnicodeString

Event ID 2: process: payload.

Channel: Admin
Level: Error

Message #

%1: %2

Fields #

Name	Description
`process` UnicodeString
`payload` UnicodeString

Example Event #

{
  "system": {
    "provider": "OpenSSH",
    "guid": "C4B57D35-0636-4BC3-A262-370F249F9802",
    "event_source_name": "",
    "event_id": 2,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036854775808,
    "time_created": "2023-10-25T22:48:38.752876+00:00",
    "event_record_id": 8,
    "correlation": {},
    "execution": {
      "process_id": 2320,
      "thread_id": 1048
    },
    "channel": "OpenSSH/Admin",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "process": "sshd",
    "payload": "error: kex_exchange_identification: Connection closed by remote host"
  },
  "message": ""
}

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 3: process: payload.

Channel: Operational

Message #

%1: %2

Fields #

Name	Description
`process` UnicodeString
`payload` UnicodeString

Event ID 4: process: payload.

Channel: Operational
Level: Informational

Message #

%1: %2

Fields #

Name	Description	Rules
`process` UnicodeString		2 detection rules
`payload` UnicodeString		2 detection rules

Example Event #

{
  "system": {
    "provider": "OpenSSH",
    "guid": "C4B57D35-0636-4BC3-A262-370F249F9802",
    "event_source_name": "",
    "event_id": 4,
    "version": 0,
    "level": 4,
    "task": 0,
    "opcode": 0,
    "keywords": 4611686018427387904,
    "time_created": "2023-10-25T22:56:14.223049+00:00",
    "event_record_id": 40,
    "correlation": {},
    "execution": {
      "process_id": 3136,
      "thread_id": 3384
    },
    "channel": "OpenSSH/Operational",
    "computer": "WinDevEval",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "process": "sshd",
    "payload": "Received signal 8; terminating."
  },
  "message": ""
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`CommandLine`	eq	`sshd`	2 rules	sigma

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma # view in coverage

OpenSSH Server Listening On Socket source medium: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.T1021, T1021.004
OpenSSH server listening on socket source medium: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.T1021, T1021.004

References #

Example event sourced from https://github.com/NextronSystems/evtx-baseline

Event ID 6: process: payload.

Channel: Debug

Message #

%1: %2

Fields #

Name	Description
`process` UnicodeString
`payload` UnicodeString

Provenance

ETW provider GUID c4b57d35-0636-4bc3-a262-370f249f9802

Defined in ssh-agent.exe, which carries the event manifest.

WS2022-20348.4893, schema read from the registered manifest, binary version 9.5.5.1, captured 2026-06-02 — Manifest XML pack, 1.9 MB
Win11-26200.6584, schema read from the registered manifest, binary version 9.5.5.1, captured 2026-06-02 — Manifest XML pack, 2.0 MB