Binary Proxy Execution via Windows OpenSSH

[rule]
description = """
Identifies attempts to execute programs via the Windows OpenSSH client. This may indicate an attempt to bypass
application control via trusted windows binaries.
"""
id = "a9b41132-04c7-421e-9aaf-b2c8718a66d0"
license = "Elastic License v2"
name = "Binary Proxy Execution via Windows OpenSSH"
os_list = ["windows"]
reference = ["https://lolbas-project.github.io/lolbas/Binaries/Ssh/"]
version = "1.0.7"

query = '''
process where event.action == "start" and
(
 (process.parent.executable : ("?:\\windows\\system32\\OpenSSH\\ssh.exe", "C:\\Windows\\System32\\OpenSSH\\sftp.exe") and
 process.parent.args == "-o" and process.parent.command_line : ("*ProxyCommand=*", "*LocalCommand=*") and
 not process.executable : ("?:\\Windows\\system32\\conhost.exe", "?:\\Program Files\\Amazon\\AWSCLIV2\\aws.exe", "C:\\Windows\\System32\\OpenSSH\\ssh.exe")) or

 (process.executable : ("?:\\windows\\system32\\OpenSSH\\ssh.exe", "C:\\Windows\\System32\\OpenSSH\\sftp.exe") and
  process.parent.name : ("explorer.exe", "python.exe", "conhost.exe") and
  process.command_line : ("*Command=*powershell*", "*schtasks*create*", "*LocalCommand=@echo off &&*",
                          "*Command=cmd /c*", "*ProxyCommand=*cmd.exe *", "*Command=\"cmd /c*", "*LocalCommand=scp*&&*", "*LocalCommand=?scp*&&*") )
)
'''

min_endpoint_version = "7.16.0"
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
tree = true

[[optional_actions]]
action = "rollback"
field = "process.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1218"
name = "System Binary Proxy Execution"
reference = "https://attack.mitre.org/techniques/T1218/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.16.0"