Detection rules › Sigma
Success login attempt on a Windows OpenSSH server
Detects scenarios where an attacker attempts to connect to a Windows host using the SSH protocol.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | T1078 Valid Accounts |
| Persistence | T1078 Valid Accounts |
| Privilege Escalation | T1078 Valid Accounts |
| Stealth | T1078 Valid Accounts |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Security-Auditing | Event ID 4624 | An account was successfully logged on. |
Rule body yaml
title: Success login attempt on a Windows OpenSSH server
description: Detects scenarios where an attacker attempts to connect to a Windows host using the SSH protocol.
remarks: This requires to have previously enabled the builtin OpenSSH server or to have installed the "OpenSSH-Win64" component. IpAddress or Workstation fields may be empty. In case Workstation field is not empty, be aware that it may wrongly report the source host. Moreover, the 1st initial connection attempt (before SSH credentials prompt) will be reported with event ID 4624, logon type 5 (service) and target user "sshd_*". Following authenticated events will be with logon type 3 (network) and 8 (clear text). For reliable source IP information, use the logs from the OpenSSH channel, event ID 4.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0001-Initial%20access/T1078-Valid%20accounts
- https://winaero.com/enable-openssh-server-windows-10/
- https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
- https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx
- https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
tags:
- attack.valid_account
- attack.t1078
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection_event:
EventID: 4624
ProcessName|endswith: '\sshd.exe'
filter_user:
TargetUserSid|startswith: 'S-1-5-111-' # Exclude "sshd_*" system events
filter_ssh_servers:
Computer: '%win_ssh_servers%' # List of Windows hosts where OpenSSH server is officialy known as installed and active.
condition: selection_event and not (filter_user or filter_ssh_servers)
falsepositives:
- Normal administrator activity
level: medium
Stages and Predicates
Stage 0: condition
selection_event and not (filter_user or filter_ssh_servers)Stage 1: selection_event
selection_event:
EventID: 4624
ProcessName|endswith: '\sshd.exe'
Stage 2: not filter_user
filter_user:
TargetUserSid|startswith: 'S-1-5-111-'
Stage 3: not filter_ssh_servers
filter_ssh_servers:
Computer: '%win_ssh_servers%'
Exclusions
Top-level NOT(...) conjuncts: predicates this rule actively suppresses.
| Field | Kind | Excluded values |
|---|---|---|
TargetUserSid | starts_with | S-1-5-111- |
Computer | eq | %win_ssh_servers% |
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
ProcessName | ends_with |
|