Suspicious one-line command executed as a direct child of sshd

Siemphony@siemphonylowT1021.004unverifiedPlaybook · Lateral movement

Matches the non-interactive half of AN1638: `ssh host 'command'` makes sshd exec the user's shell directly with `-c "command"`, so the whole remote command lands on one audited execve whose ParentImage is sshd — a shape RDP and SMB lateral movement cannot produce. Gating on a shell launcher plus suspicious content, rather than the parent alone, keeps an ordinary interactive login (a bare shell with no arguments) out of scope. The content list is authored from MITRE's SuspiciousProcessList knob ("nc, base64, bash -i") extended with the bash `/dev/tcp/` reverse-shell idiom; the login-to-execution correlation AN1638 also asks for is a cross-event join Sigma cannot express. OpenSSH 9.8 split the post-authentication session out of sshd into a separate sshd-session binary, so on current distributions the shell's parent is sshd-session and a gate on '/sshd' alone would be dead; both names are listed. Coverage limit, stated plainly: an interactive SSH login is not detected. Commands typed at a shell prompt are children of the login shell rather than of sshd, several hops from what this rule inspects, so interactive lateral movement over SSH passes unseen and only the `ssh host 'command'` shape is caught. Prerequisite: auditd does not record execve by default, so an empty result here means the syscall isn't audited rather than the estate being quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0596, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Suspicious one-line command executed as a direct child of sshd2id: 719ec44e-743d-45a4-a953-ba7d94d3fd7f3status: experimental4description: |5  Matches the non-interactive half of AN1638: `ssh host 'command'` makes sshd6  exec the user's shell directly with `-c "command"`, so the whole remote7  command lands on one audited execve whose ParentImage is sshd — a shape RDP8  and SMB lateral movement cannot produce. Gating on a shell launcher plus9  suspicious content, rather than the parent alone, keeps an ordinary10  interactive login (a bare shell with no arguments) out of scope. The content11  list is authored from MITRE's SuspiciousProcessList knob ("nc, base64, bash12  -i") extended with the bash `/dev/tcp/` reverse-shell idiom; the13  login-to-execution correlation AN1638 also asks for is a cross-event join14  Sigma cannot express. OpenSSH 9.8 split the post-authentication session out15  of sshd into a separate sshd-session binary, so on current distributions the16  shell's parent is sshd-session and a gate on '/sshd' alone would be dead;17  both names are listed. Coverage limit, stated plainly: an interactive SSH18  login is not detected. Commands typed at a shell prompt are children of the19  login shell rather than of sshd, several hops from what this rule inspects,20  so interactive lateral movement over SSH passes unseen and only the21  `ssh host 'command'` shape is caught. Prerequisite: auditd does not record22  execve by default, so an empty result here means the syscall isn't audited23  rather than the estate being quiet.24  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0596, not hand-written and not tested by its author. Any lab result is on this rule's own page.25references:26  - https://attack.mitre.org/techniques/T1021/00427  - https://attack.mitre.org/detectionstrategies/DET059628author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)29date: 2026-08-1630tags:31  - attack.lateral-movement32  - attack.t1021.00433logsource:34  category: process_creation35  product: linux36detection:37  selection_parent:38    ParentImage|endswith:39      - '/sshd'40      - '/sshd-session'41  selection_shell:42    Image|endswith:43      - '/bash'44      - '/sh'45      - '/dash'46      - '/zsh'47  selection_suspicious:48    CommandLine|contains:49      - 'base64 -d'50      - 'base64 --decode'51      - '/dev/tcp/'52      - 'nc -e'53      - 'ncat -e'54      - 'socat exec'55      - 'mkfifo'56      - '0>&1'57  condition: selection_parent and selection_shell and selection_suspicious58falsepositives:59  - "Ansible's default SSH connection plugin, which wraps every module execution as `sh -c 'echo ... ; base64 -d ...'` piped through a decode step run directly under sshd. On any host managed by Ansible this is the highest-volume match by a wide margin and fires on ordinary configuration runs, not just when a base64 term is used maliciously."60  - "Backup, log-shipping and media-processing scripts invoked over SSH that create a named pipe with `mkfifo` to stream data without a temp file. The term is one of the eight triggers and is ordinary shell craft, so any scheduled job of this shape matches every run on a busy ops or build host."61  - "CI and release steps run as `ssh host 'command'` that move a small artefact, key or config blob inline by piping it through `base64 -d` on the far side, which matches the same decode term as the Ansible case and recurs at every pipeline execution."62  - "Remote one-off maintenance commands an administrator runs with `ssh host 'command'` — for example decoding a base64-encoded config blob or piping a downloaded script through the shell — which is the exact shape this rule is built to catch and is separated from an intrusion only by who ran it and why."63level: low

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((InitiatingProcessFolderPath endswith "/sshd" or InitiatingProcessFolderPath endswith "/sshd-session") and (FolderPath endswith "/bash" or FolderPath endswith "/sh" or FolderPath endswith "/dash" or FolderPath endswith "/zsh")) and (ProcessCommandLine contains "base64 -d" or ProcessCommandLine contains "base64 --decode" or ProcessCommandLine contains "/dev/tcp/" or ProcessCommandLine contains "nc -e" or ProcessCommandLine contains "ncat -e" or ProcessCommandLine contains "socat exec" or ProcessCommandLine contains "mkfifo" or ProcessCommandLine contains "0>&1"))

Splunk · SPL

Run this as a search.

index=* (((ParentImage="*/sshd" OR ParentImage="*/sshd-session") AND (Image="*/bash" OR Image="*/sh" OR Image="*/dash" OR Image="*/zsh")) AND (CommandLine="*base64 -d*" OR CommandLine="*base64 --decode*" OR CommandLine="*/dev/tcp/*" OR CommandLine="*nc -e*" OR CommandLine="*ncat -e*" OR CommandLine="*socat exec*" OR CommandLine="*mkfifo*" OR CommandLine="*0>&1*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(process.parent.executable) LIKE "*/sshd" OR TO_LOWER(process.parent.executable) LIKE "*/sshd-session") AND (TO_LOWER(process.executable) LIKE "*/bash" OR TO_LOWER(process.executable) LIKE "*/sh" OR TO_LOWER(process.executable) LIKE "*/dash" OR TO_LOWER(process.executable) LIKE "*/zsh")) AND (TO_LOWER(process.command_line) LIKE "*base64 -d*" OR TO_LOWER(process.command_line) LIKE "*base64 --decode*" OR TO_LOWER(process.command_line) LIKE "*/dev/tcp/*" OR TO_LOWER(process.command_line) LIKE "*nc -e*" OR TO_LOWER(process.command_line) LIKE "*ncat -e*" OR TO_LOWER(process.command_line) LIKE "*socat exec*" OR TO_LOWER(process.command_line) LIKE "*mkfifo*" OR TO_LOWER(process.command_line) LIKE "*0>&1*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="ParentImage" type="pcre2">(?i)(/sshd$|/sshd-session$)</field>    <field name="Image" type="pcre2">(?i)(/bash$|/sh$|/dash$|/zsh$)</field>    <field name="CommandLine" type="pcre2">(?i)(base64 -d|base64 --decode|/dev/tcp/|nc -e|ncat -e|socat exec|mkfifo|0&gt;&amp;1)</field>    <description>Suspicious one-line command executed as a direct child of sshd</description>    <mitre>      <id>T1021.004</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: low
Category: lateral_movement_remote_exec
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 719ec44e-743d-45a4-a953-ba7d94d3fd7f

ATT&CKT1021.004

T1021.004SSH

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1021.004, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Add more specific conditions to filter out known benign uses of base64 decoding or network tools
Implement a whitelist for specific CommandLine values known to be used by legitimate software
Consider adding a condition to look for commands that are executed in quick succession, indicating potential automated malicious activity
Filter out events where the ParentImage is not a direct child of sshd, to reduce noise from nested process creations

Declared by the author

Ansible's default SSH connection plugin, which wraps every module execution as sh -c 'echo ... ; base64 -d ...' piped through a decode step run directly under sshd. On any host managed by Ansible this is the highest-volume match by a wide margin and fires on ordinary configuration runs, not just when a base64 term is used maliciously.
Backup, log-shipping and media-processing scripts invoked over SSH that create a named pipe with mkfifo to stream data without a temp file. The term is one of the eight triggers and is ordinary shell craft, so any scheduled job of this shape matches every run on a busy ops or build host.
CI and release steps run as ssh host 'command' that move a small artefact, key or config blob inline by piping it through base64 -d on the far side, which matches the same decode term as the Ansible case and recurs at every pipeline execution.
Remote one-off maintenance commands an administrator runs with ssh host 'command' — for example decoding a base64-encoded config blob or piping a downloaded script through the shell — which is the exact shape this rule is built to catch and is separated from an intrusion only by who ran it and why.

Lessonlateral movement remote exec

lateral movement remote execAI draft — unreviewed

01 · What this rule detects

This Sigma rule detects suspicious one-line commands executed directly under the sshd process, which could indicate lateral movement and remote execution techniques used by attackers. The rule focuses on commands that are typically used for decoding or executing malicious payloads, establishing reverse shells, or creating backdoors, and are executed in a single line, often through a shell like bash, sh, dash, or zsh.

02 · Telemetry you need

Log source: process creation events
Specific fields: ParentImage, Image, CommandLine
Audit setting: process creation logging must be enabled, which might be off by default in some Linux distributions

03 · How the logic works

The rule works by selecting processes that meet three conditions: the parent process is sshd (or a variant like sshd-session), the process image is a shell (like bash, sh, dash, or zsh), and the command line contains suspicious elements such as base64 decoding, network connections via nc, ncat, or socat, or other indicators of potential malicious activity. If all these conditions are met, the rule flags the event as suspicious.

04 · Common false positives

Automated backup scripts that use base64 for encoding data
System administration tools that utilize nc or socat for legitimate network testing
Software installation scripts that execute shell commands in a single line
Legitimate use of mkfifo for creating named pipes in system automation

05 · Detection maturity

tier_1: The rule as written provides a basic detection capability but may generate significant noise due to its broad conditions.
tier_2: With tuning, such as adding specific whitelists or filtering out known benign activity, the rule can become more accurate and reduce false positives.
tier_3: Correlating this rule with other signals, such as network anomaly detections or login attempt failures, can significantly enhance its effectiveness in identifying lateral movement and remote execution attacks.

Related detections2 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/719ec44e-743d-45a4-a953-ba7d94d3fd7f

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Suspicious one-line command executed as a direct child of sshd

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it