T1021.004 — SSH

Tactic: Lateral Movement · Platforms: ESXi, Linux, macOS

Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by…

Sub-technique of Remote Services (T1021).

Sigma detection rules (3)

T1021.004 Remote Services: SSH

title: "T1021.004 Remote Services: SSH"
id: eb2ef822-b674-44bb-8c2b-c8875648f9eb
description: 'Behavioral Detection of Remote SSH Logins (T1021.004). The prior version matched any execution of the ssh client binary — a tautology that fires on virtually every legitimate SSH use with no login/chain logic implemented. Detecting the full login-then-post-login-execution chain requires correlating this event with subsequent process_creation activity in the same session, which a single detection rule cannot express. This version retargets to the closest single-event proxy that is still specific and real: a successful sshd authentication (auditd USER_LOGIN, res=success) recorded on the target host, which is the actual SSH login itself. Tune using: TimeWindow, SuspiciousProcessList, UsernameFilter.'
references:
  - https://attack.mitre.org/techniques/T1021/004
author: Shahrukh Khan
date: 2026-04-14
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1021.004

logsource:
  category: authentication
  product: linux
  service: auditd

detection:
  selection:
    type: USER_LOGIN
    exe|endswith: '/sshd'
    res: 'success'
  condition: selection

falsepositives:
  - Legitimate interactive or automated SSH administration; this rule flags the login event itself and cannot by itself distinguish authorized lateral administration from adversary use of valid accounts. Correlate with unusual source host/account pairs, off-hours timing, or suspicious child-process execution in the same auditd session to raise confidence.

level: low

T1021.004 Remote Services: SSH

title: "T1021.004 Remote Services: SSH"
id: 421bb365-6032-4e2c-9bbc-599e4541abc2
description: 'Behavioral Detection of Remote SSH Logins Followed by Post-Login Execution. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, UserContext, CommandLineKeywords.'
references:
  - https://attack.mitre.org/techniques/T1021/004
author: Shahrukh Khan
date: 2026-05-24
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1021.004

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/ssh'
  selection_insecure:
    CommandLine|contains:
      - 'StrictHostKeyChecking=no'
      - '-i /tmp/'
  condition: selection and selection_insecure

falsepositives:
  - Automation or CI scripts that intentionally disable host key checking for ephemeral build agents.

level: medium

T1021.004 Remote Services: SSH

title: "T1021.004 Remote Services: SSH"
id: dd0d908e-edab-4d51-b44a-9bf8f3212ce8
description: 'Behavioral Detection of Remote SSH Logins Followed by Post-Login Execution. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AllowedUsers, TimeWindow, CommandList.'
references:
  - https://attack.mitre.org/techniques/T1021/004
author: Shahrukh Khan
date: 2026-04-07
license: MIT
tags:
  - attack.lateral-movement
  - attack.t1021.004

logsource:
  product: esxi
  service: auth

detection:
  selection:
    Message|contains: 'sshd'
  selection_success:
    Message|contains: 'Accepted password'

  condition: selection and selection_success

falsepositives:
  - Administrators with legitimate SSH access enabled via TSM also generate accepted-password events, so allow-listing expected admin accounts and maintenance windows reduces noise.

level: medium

Related sub-techniques

Explore