SSH
Where this stands
One published detection covers this technique. Every one is unverified — no rule on Siemphony has been executed against real telemetry.
What the technique is
Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via vim-cmd hostsvc/enable_ssh) or via vCenter. The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user (i.e., SSH Authorized Keys).
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1638
SSH login from a remote system (via sshd), followed by user context execution of suspicious binaries or privilege escalation behavior.
- AN1639
SSH login detected via Unified Logs, followed by unusual process execution, especially outside normal user behavior patterns.
- AN1640
SSH login via hostd or /var/log/auth.log, followed by CLI access to host shell or file manipulation in restricted areas.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.