SSH
Adversaries may use [Valid Accounts](https://attack.mitre.org/techniques/T1078) to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via `vim-cmd hostsvc/enable_ss...
BY SOURCE
PROCEDURES (21)
Auto-extracted: 4 detections for authentication monitoring
Auto-extracted: 3 detections for service
Auto-extracted: 2 detections for encrypt
Auto-extracted: 2 detections for c2
Auto-extracted: 2 detections for general monitoring
Auto-extracted: 2 detections for persist
Auto-extracted: 2 detections for privilege
Auto-extracted: 1 detections for download
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for remote
Auto-extracted: 1 detections for exfiltrat
Auto-extracted: 1 detections for unusual
Auto-extracted: 1 detections for child process
Auto-extracted: 1 detections for http
Auto-extracted: 1 detections for bypass
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for tunnel
Auto-extracted: 1 detections for powershell
Auto-extracted: 1 detections for process creation monitoring
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for tunnel