Detection rules › Sigma
Success login attempt on a Windows OpenSSH server
Detects scenarios where an attacker attempts to connect to a Windows host using the SSH protocol.
Known false positives
- Normal administrator activity
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Initial Access | |
| Persistence | |
| Privilege Escalation | |
| Stealth |
Telemetry coverage
| Provider | Record / event type |
|---|---|
| Security-Auditing | Event ID 4624: An account was successfully logged on. |
Rule body
title: Success login attempt on a Windows OpenSSH server
description: Detects scenarios where an attacker attempts to connect to a Windows host using the SSH protocol.
remarks: This requires to have previously enabled the builtin OpenSSH server or to have installed the "OpenSSH-Win64" component. IpAddress or Workstation fields may be empty. In case Workstation field is not empty, be aware that it may wrongly report the source host. Moreover, the 1st initial connection attempt (before SSH credentials prompt) will be reported with event ID 4624, logon type 5 (service) and target user "sshd_*". Following authenticated events will be with logon type 3 (network) and 8 (clear text). For reliable source IP information, use the logs from the OpenSSH channel, event ID 4.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0001-Initial%20access/T1078-Valid%20accounts
- https://winaero.com/enable-openssh-server-windows-10/
- https://docs.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
- https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx
- https://www.microsoft.com/en-us/security/blog/2022/10/18/defenders-beware-a-case-for-post-ransomware-investigations/
tags:
- attack.valid_account
- attack.t1078
author: mdecrevoisier
status: experimental
logsource:
product: windows
service: security
detection:
selection_event:
EventID: 4624
ProcessName|endswith: '\sshd.exe'
filter_user:
TargetUserSid|startswith: 'S-1-5-111-' # Exclude "sshd_*" system events
filter_ssh_servers:
Computer: '%win_ssh_servers%' # List of Windows hosts where OpenSSH server is officialy known as installed and active.
condition: selection_event and not (filter_user or filter_ssh_servers)
falsepositives:
- Normal administrator activity
level: medium
Stages and Predicates
Stage 0: condition
selection_event and not (filter_user or filter_ssh_servers)Stage 1: selection_event
selection_event:
EventID: 4624
ProcessName|endswith: '\sshd.exe'
Stage 2: not filter_user
filter_user:
TargetUserSid|startswith: 'S-1-5-111-'
Stage 3: not filter_ssh_servers
filter_ssh_servers:
Computer: '%win_ssh_servers%'
Exclusions
The rule actively suppresses these predicates.
| Field | Kind | Excluded values | Search |
|---|---|---|---|
TargetUserSid | starts_with | S-1-5-111- | excludes:TargetUserSid field:"TargetUserSid" value:"S-1-5-111-" |
Computer | eq | %win_ssh_servers% | excludes:Computer field:"Computer" value:"%win_ssh_servers%" |
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
ProcessName | ends_with |
| field:"process_name" kind:ends_with value:"\sshd.exe" |