OpenSSH native server feature installation

title: OpenSSH native server feature installation
description: Detects scenarios where an attacker enables the native OpenSSH server feature on Windows to perform stealthy lateral movement.
references:
 - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH
 - https://winaero.com/enable-openssh-server-windows-10/
 - https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
 - https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx
 - https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
tags:
- attack.lateral_movement
- attack.t1021.004
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category:
    - ps_module
    - ps_classic_script
    - ps_script
detection:
  selection_powershell_native:
    EventID: 800
    EventData|contains|all:
      - Add-WindowsCapability
      - OpenSSH.Server

  selection_powershell_modern:
    EventID: 4103
    Payload|contains|all:
      - Add-WindowsCapability
      - OpenSSH.Server

  selection_powershell_block:
    EventID: 4104
    ScriptBlockText|contains|all:
      - Add-WindowsCapability
      - OpenSSH.Server

  condition: 1 of selection*
falsepositives:
- legitimate administrator installation
- developer computer
level: medium