detection.wiki

Detection rules › Panther

OSQuery Detected SSH Listener

Severity
medium
Log types
Osquery.Differential
Tags
Osquery, Lateral Movement:Remote Services
Reference
https://medium.com/uptycs/osquery-what-it-is-how-it-works-and-how-to-use-it-ce4e81e60dfc
Source
github.com/panther-labs/panther-analysis

Check if SSH is listening in a non-production environment. This could be an indicator of persistent access within an environment.

MITRE ATT&CK coverage

TacticTechniques
Lateral MovementT1021 Remote Services

Rule body yaml

AnalysisType: rule
Filename: osquery_ssh_listener.py
RuleID: "Osquery.SSHListener"
DisplayName: "OSQuery Detected SSH Listener"
Enabled: true
LogTypes:
  - Osquery.Differential
Tags:
  - Osquery
  - Lateral Movement:Remote Services
Reports:
  MITRE ATT&CK:
    - TA0008:T1021
Severity: Medium
Description: >
  Check if SSH is listening in a non-production environment. This could be an indicator of persistent access within an environment.
Runbook: >
  Terminate the SSH daemon, investigate for signs of compromise.
Reference: https://medium.com/uptycs/osquery-what-it-is-how-it-works-and-how-to-use-it-ce4e81e60dfc
SummaryAttributes:
  - action
  - hostIdentifier
  - name
Tests:
  - Name: SSH Listener Detected
    ExpectedResult: true
    Log:
      {
        "action": "added",
        "calendarTime": "Tue Sep 11 16:14:21 2018 UTC",
        "columns":
          {
            "build_distro": "10.12",
            "build_platform": "darwin",
            "config_hash": "1111",
            "config_valid": "1",
            "counter": "14",
            "global_state": "0",
            "extensions": "active",
            "instance_id": "1111",
            "pid": "223",
            "port": "22",
            "resident_size": "54894592",
            "start_time": "1536634519",
            "system_time": "12472",
            "user_time": "31800",
            "uuid": "37821E12-CC8A-5AA3-A90C-FAB28A5BF8F9",
            "version": "Not Supported",
            "watcher": "92",
          },
        "counter": "255",
        "decorations": { "host_uuid": "1111", "environment": "corp" },
        "epoch": "0",
        "hostIdentifier": "test.lan",
        "log_type": "result",
        "name": "pack_incident-response_listening_ports",
        "unixTime": "1536682461",
      }
  - Name: SSH Listener Not Detected
    ExpectedResult: false
    Log:
      {
        "action": "added",
        "calendarTime": "Tue Sep 11 16:14:21 2018 UTC",
        "columns":
          {
            "build_distro": "10.12",
            "build_platform": "darwin",
            "config_hash": "1111",
            "config_valid": "1",
            "counter": "14",
            "global_state": "2",
            "extensions": "active",
            "instance_id": "1111",
            "pid": "223",
            "port": "443",
            "resident_size": "54894592",
            "start_time": "1536634519",
            "system_time": "12472",
            "user_time": "31800",
            "uuid": "37821E12-CC8A-5AA3-A90C-FAB28A5BF8F9",
            "version": "10.14.2",
            "watcher": "92",
          },
        "counter": "255",
        "decorations": { "host_uuid": "1111", "environment": "corp" },
        "epoch": "0",
        "hostIdentifier": "test.lan",
        "log_type": "result",
        "name": "pack_incident-response_listening_ports",
        "unixTime": "1536682461",
      }

Detection logic

Condition

name eq "pack_incident-response_listening_ports"
columns.port eq "22"
action eq "added"

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
actioneq
  • added corpus 10 (panther 10)
columns.porteq
  • 22
nameeq
  • pack_incident-response_listening_ports