Behavioral Detection of Remote SSH Logins Followed by Post-Login Execution

Technique Detected:  SSH | T1021.004

ID: DET0596
Domains: Enterprise
Analytics: AN1638, AN1639, AN1640
Version: 1.0
Created: 21 October 2025
Last Modified: 21 October 2025

Analytics

AN1638

SSH login from a remote system (via sshd), followed by user context execution of suspicious binaries or privilege escalation behavior.

Log Sources
Data Component Name Channel
Process Creation (DC0032) auditd:EXECVE EXECVE
Logon Session Creation (DC0067) linux:syslog None
Network Traffic Flow (DC0078) NSM:Flow TCP port 22 traffic
Mutable Elements
Field Description
TimeWindow Defines correlation window from login to first post-SSH process (e.g., 60s)
SuspiciousProcessList List of binaries considered unusual in SSH context (e.g., nc, base64, bash -i)
UsernameFilter Accounts of interest for SSH logins (e.g., root, admin)

AN1639

SSH login detected via Unified Logs, followed by unusual process execution, especially outside normal user behavior patterns.

Log Sources
Data Component Name Channel
Logon Session Metadata (DC0088) macos:unifiedlog process = 'sshd'
Network Traffic Content (DC0085) macos:unifiedlog process = 'ssh' OR eventMessage CONTAINS 'ssh'
Process Creation (DC0032) macos:osquery process_events
Mutable Elements
Field Description
TimeWindow Time range to correlate post-SSH activities (e.g., 45s)
UserContext Define authorized users to reduce false positives
CommandLineKeywords Suspicious terms like reverse shells, base64, curl

AN1640

SSH login via hostd or /var/log/auth.log, followed by CLI access to host shell or file manipulation in restricted areas.

Log Sources
Data Component Name Channel
Logon Session Metadata (DC0088) esxi:auth None
Command Execution (DC0064) esxi:shell None
Network Traffic Flow (DC0078) esxi:vmkernel port 22 access
Mutable Elements
Field Description
AllowedUsers Legitimate SSH users to this host
TimeWindow Correlate SSH login and unauthorized commands or shell access
CommandList Flag commands like esxcli, rm, chmod post-login