EXPLORE
← Back to Explore
T1021.004

SSH

Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via `vim-cmd hostsvc/enable_ss...

ESXiLinuxmacOS
31
Detections
4
Sources
19
Threat Actors

BY SOURCE

18elastic7splunk_escu5sigma1crowdstrike_cql

PROCEDURES (21)

Authentication Monitoring4 detections

Auto-extracted: 4 detections for authentication monitoring

Service3 detections

Auto-extracted: 3 detections for service

Encrypt2 detections

Auto-extracted: 2 detections for encrypt

C22 detections

Auto-extracted: 2 detections for c2

General Monitoring2 detections

Auto-extracted: 2 detections for general monitoring

Persist2 detections

Auto-extracted: 2 detections for persist

Privilege2 detections

Auto-extracted: 2 detections for privilege

Download1 detections

Auto-extracted: 1 detections for download

Http1 detections

Auto-extracted: 1 detections for http

Remote1 detections

Auto-extracted: 1 detections for remote

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Unusual1 detections

Auto-extracted: 1 detections for unusual

Child Process1 detections

Auto-extracted: 1 detections for child process

Http1 detections

Auto-extracted: 1 detections for http

Bypass1 detections

Auto-extracted: 1 detections for bypass

Credential1 detections

Auto-extracted: 1 detections for credential

Tunnel1 detections

Auto-extracted: 1 detections for tunnel

Powershell1 detections

Auto-extracted: 1 detections for powershell

Process Creation Monitoring1 detections

Auto-extracted: 1 detections for process creation monitoring

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Tunnel1 detections

Auto-extracted: 1 detections for tunnel

DETECTIONS (31)

AWS EC2 Instance Connect SSH Public Key Uploaded
elasticmedium
Bitbucket Global SSH Settings Changed
sigmamedium
Bitbucket User Login Failure Via SSH
sigmamedium
Cisco Privileged Account Creation with HTTP Command Execution
splunk_escu
Cisco Privileged Account Creation with Suspicious SSH Activity
splunk_escu
Cisco Secure Firewall - SSH Connection to Non-Standard Port
splunk_escu
Cisco Secure Firewall - SSH Connection to sshd_operns
splunk_escu
ESXi SSH Enabled
splunk_escu
Linux SSH Remote Services Script Execute
splunk_escu
Linux SSH X11 Forwarding
elasticlow
Network Connection Initiated by Suspicious SSHD Child Process
elasticmedium
OpenEDR Spawning Command Shell
sigmamedium
OpenSSH Server Listening On Socket
sigmamedium
Port Forwarding Activity Via SSH.EXE
sigmamedium
Potential Execution via SSH Backdoor
elasticmedium
Potential Internal Linux SSH Brute Force Detected
elasticmedium
Potential Remote Desktop Tunneling Detected
elastichigh
Potential THC Tool Downloaded
elastichigh
Remote File Creation in World Writeable Directory
elasticmedium
Remote Port Forwarding via Plink - Unauthorized RDP Tunneling Detection
crowdstrike_cql
Remote SSH Login Enabled via systemsetup Command
elasticmedium
Renaming of OpenSSH Binaries
elasticlow
SSH Authorized Key File Activity Detected via Defend for Containers
elasticmedium
SSH Authorized Keys File Activity
elasticmedium
SSH Key Generated via ssh-keygen
elasticlow
Successful SSH Authentication from Unusual IP Address
elasticlow
Successful SSH Authentication from Unusual SSH Public Key
elasticlow
Successful SSH Authentication from Unusual User
elasticlow
Unusual Remote File Creation
elasticlow
Unusual SSHD Child Process
elasticlow
Windows Protocol Tunneling with Plink
splunk_escu