Detection Strategies DET0596 — Behavioral Detection of Remote SSH Logins Followed by Post-Login Execution

DET0596

Behavioral Detection of Remote SSH Logins Followed by Post-Login Execution

3 analytic(s) · 1 technique(s) detected

Analytics

AN1638 Analytic 1638

Linux

SSH login from a remote system (via sshd), followed by user context execution of suspicious binaries or privilege escalation behavior.

auditd:EXECVE EXECVE linux:syslog None NSM:Flow TCP port 22 traffic

[TimeWindow] Defines correlation window from login to first post-SSH process (e.g., 60s)

[SuspiciousProcessList] List of binaries considered unusual in SSH context (e.g., nc, base64, bash -i)

[UsernameFilter] Accounts of interest for SSH logins (e.g., root, admin)

AN1639 Analytic 1639

macOS

SSH login detected via Unified Logs, followed by unusual process execution, especially outside normal user behavior patterns.

macos:unifiedlog process = 'sshd' macos:unifiedlog process = 'ssh' OR eventMessage CONTAINS 'ssh' macos:osquery process_events

[TimeWindow] Time range to correlate post-SSH activities (e.g., 45s)

[UserContext] Define authorized users to reduce false positives

[CommandLineKeywords] Suspicious terms like reverse shells, base64, curl

AN1640 Analytic 1640

ESXi

SSH login via hostd or `/var/log/auth.log`, followed by CLI access to host shell or file manipulation in restricted areas.

esxi:auth None esxi:shell None esxi:vmkernel port 22 access

[AllowedUsers] Legitimate SSH users to this host

[TimeWindow] Correlate SSH login and unauthorized commands or shell access

[CommandList] Flag commands like esxcli, rm, chmod post-login

Lateral Movement (1)