ssh.exe Execution (Sysmon)

id: '25328.47113'
title: ssh.exe Execution
description: 'ssh.exe is a legitimate SSH client included in Windows systems,providing
  secure shell access to remote servers. Due to its availability and capabilities,
  it can be exploited by attackers for covert communication, remote command execution,
  or tunneling, making it a potential tool for living-off-the-land attacks. This use
  case detects executions of ssh.exe. -- Threat Actor Association: APT28 (aka.Fancy
  Bear, Fighting Ursa, Forest Blizzard, Pawn Storm, TA422, STRONTIUM) -- Living Off
  the Land Binary and Scripts (LOLBAS) (LOLBIN)'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_sysmon` (TERM(EventCode=1) OR "<EventID>1<")
  TERM(ssh) OR "ssh.exe" | where match(process_name, "(?i)^ssh\.exe")| table _time,
  host, user, process, process_*, parent_process_* | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- defense-evasion:indirect command execution
- command-and-control:protocol tunneling
technique_id: 
- T1202
- T1572
data_category:
- Windows Sysmon
references:
- https://lolbas-project.github.io/lolbas/Binaries/Ssh/