AN0710
Analytic 0710
Linux
Suspicious reuse of SSH agent sockets across multiple users or processes, anomalous access to ~/.ssh/ or /tmp/ssh-* sockets, and abnormal patterns of lateral movement via SSH without new authentication events. Defender view: detect when one process accesses another user's SSH agent or when an existing SSH connection is used to pivot unexpectedly.
auditd:SYSCALL
open or connect syscalls on /tmp/ssh-* or $SSH_AUTH_SOCK
auditd:EXECVE
Execution of ssh/scp/sftp without corresponding authentication log
NSM:Connections
Missing new login event but session activity continues
[UserContext]
Tune alerts for cross-user access to SSH agent sockets.
[TimeWindow]
Correlate lack of authentication with lateral SSH activity within a short timeframe.
AN0711
Analytic 0711
macOS
Unusual access to SSH agent sockets in /tmp/ or /private/tmp, process access to another user’s $SSH_AUTH_SOCK, and lateral SSH activity without corresponding login events. Defender view: correlation of socket access with anomalous network flows to internal systems.
macos:unifiedlog
Process opening SSH_AUTH_SOCK or /tmp/ssh-* socket not owned by same UID
macos:unifiedlog
Execution of ssh or sftp without corresponding login event
macos:unifiedlog
Session reuse without new auth event
[SocketPathScope]
Limit detection to monitored SSH agent socket directories.
[BaselineUsers]
Establish normal SSH agent ownership and expected usage for tuning.