Detection rules › Sigma
OpenSSH server listening on socket
Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.
Known false positives
- legitimate administrator activation
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| OpenSSH | Event ID 4: process: payload. |
Rule body
title: OpenSSH server listening on socket
description: Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH
- https://winaero.com/enable-openssh-server-windows-10/
- https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
- https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx
- https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
tags:
- attack.lateral_movement
- attack.t1021.004
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: openssh # Channel: 'OpenSSH/Operational'
detection:
selection:
EventID: 4
process: sshd
payload|startswith: 'Server listening on'
condition: selection
falsepositives:
- legitimate administrator activation
level: medium
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
EventID: 4
process: sshd
payload|startswith: 'Server listening on'
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
payload | starts_with |
| field:"payload" kind:starts_with value:"Server listening on" |
process | eq |
| field:"CommandLine" kind:eq value:"sshd" |