Detection rules › Sigma
OpenSSH server listening on socket
Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement | T1021.004 Remote Services: SSH |
Event coverage
| Provider | Event | Title |
|---|---|---|
| OpenSSH | Event ID 4 | process: payload. |
Rule body yaml
title: OpenSSH server listening on socket
description: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH
- https://winaero.com/enable-openssh-server-windows-10/
- https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
- https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx
- https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
tags:
- attack.lateral_movement
- attack.t1021.004
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: openssh # Channel: 'OpenSSH/Operational'
detection:
selection:
EventID: 4
process: sshd
payload|startswith: 'Server listening on'
condition: selection
falsepositives:
- legitimate administrator activation
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 4
process: sshd
payload|startswith: 'Server listening on'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.