Detectionmediumtest

OpenSSH Server Listening On Socket

Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

mdecrevoisierCreated Tue Oct 253ce8e9a4-bc61-4c9b-8e69-d7e2492a8781windows

Log Source

Windowsopenssh

ProductWindows← raw: windows

Serviceopenssh← raw: openssh

Detection Logic

detection:
    selection:
        EventID: 4
        process: sshd
        payload|startswith: 'Server listening on '
    condition: selection

False Positives

Legitimate administrator activity

References

MITRE ATT&CK

Tactics

Sub-techniques

Rule Metadata

Rule ID

3ce8e9a4-bc61-4c9b-8e69-d7e2492a8781

Status

test

Level

medium

Type

Detection

Created

Tue Oct 25

Author

Path

rules/windows/builtin/openssh/win_sshd_openssh_server_listening_on_socket.yml

Raw Tags

attack.lateral-movementattack.t1021.004