Detection rules › Splunk
ssh.exe Execution (Sysmon)
ssh.exe is a legitimate SSH client included in Windows systems,providing secure shell access to remote servers. Due to its availability and capabilities, it can be exploited by attackers for covert communication, remote command execution, or tunneling, making it a potential tool for living-off-the-land attacks. This use case detects executions of ssh.exe
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth | T1202 Indirect Command Execution |
| Command & Control | T1572 Protocol Tunneling |
References
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
Rule body yaml
id: '25328.47113'
title: ssh.exe Execution
description: 'ssh.exe is a legitimate SSH client included in Windows systems,providing
secure shell access to remote servers. Due to its availability and capabilities,
it can be exploited by attackers for covert communication, remote command execution,
or tunneling, making it a potential tool for living-off-the-land attacks. This use
case detects executions of ssh.exe. -- Threat Actor Association: APT28 (aka.Fancy
Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM) -- Living Off
the Land Binary and Scripts (LOLBAS) (LOLBIN)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
TERM(ssh) OR "ssh.exe" | where match(process_name, "(?i)^ssh\.exe")| table _time,
host, user, process, process_*, parent_process_* | bin span=1s | stats values(*)
as * by _time, host '
techniques:
- defense-evasion:indirect command execution
- command-and-control:protocol tunneling
technique_id:
- T1202
- T1572
data_category:
- Windows Sysmon
references:
- https://lolbas-project.github.io/lolbas/Binaries/Ssh/
Stages and Predicates
Stage 1: search
`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<") TERM(ssh) OR "ssh.exe"
Stage 2: where
| where match(process_name, "(?i)^ssh\.exe")
Stage 3: table
| table _time, host, user, process, process_*, parent_process_*
Stage 4: bucket
| bin span=1s
Stage 5: stats
| stats values(*) as * by _time, host
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
EventCode | eq |
|
process_name | match |
|
Search terms
Bare-string tokens in the SPL search body. Splunk matches each token against _raw (the untyped raw event text) anywhere it appears, not against a specific field. These don't surface in the Indicators table because they aren't predicates on a known field.
| Stage | Term |
|---|---|
| 1 | TERM |
| 1 | "<EventID>1<" |
| 1 | TERM |
| 1 | ssh |
| 1 | "ssh.exe" |