Detection rules › Sigma

OpenSSH server listening on socket

Status
experimental
Severity
medium
Log source
product windows, service openssh
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.

MITRE ATT&CK coverage

TacticTechniques
Lateral MovementT1021.004 Remote Services: SSH

Event coverage

ProviderEventTitle
OpenSSHEvent ID 4process: payload.

Rule body yaml

title: OpenSSH server listening on socket
description: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.
references:
 - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH
 - https://winaero.com/enable-openssh-server-windows-10/
 - https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
 - https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx
 - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
tags:
- attack.lateral_movement
- attack.t1021.004
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: openssh # Channel: 'OpenSSH/Operational'
detection:
  selection:
    EventID: 4
    process: sshd
    payload|startswith: 'Server listening on'
  condition: selection
falsepositives:
- legitimate administrator activation
level: medium

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  EventID: 4
  process: sshd
  payload|startswith: 'Server listening on'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
payloadstarts_with
  • Server listening on
processeq
  • sshd corpus 2 (sigma 2)