Remote Services: SSH

Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.

SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user.

ID: T1021.004
Sub-technique of:  T1021
Platforms: Linux, macOS
System Requirements: An SSH server is configured and running.
Version: 1.2
Created: 11 February 2020
Last Modified: 11 August 2023

Procedure Examples

ID Name Description
G0087 APT39

APT39 used secure shell (SSH) to move laterally among their targets.[1]

G0098 BlackTech

BlackTech has used Putty for remote access.[2]

S0154 Cobalt Strike

Cobalt Strike can SSH to a remote service.[3][4]

S0363 Empire

Empire contains modules for executing commands over SSH as well as in-memory VNC agent injection.[5]

G1016 FIN13

FIN13 has remotely accessed compromised environments via secure shell (SSH) for lateral movement.[6]

G0046 FIN7

FIN7 has used SSH to move laterally through victim environments.[7]

G0117 Fox Kitten

Fox Kitten has used the PuTTY and Plink tools for lateral movement.[8]

G0036 GCMAN

GCMAN uses Putty for lateral movement.[9]

S0599 Kinsing

Kinsing has used SSH for lateral movement.[10]

G0032 Lazarus Group

Lazarus Group used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network.[11]

G0065 Leviathan

Leviathan used ssh for internal reconnaissance.[12]

G0045 menuPass

menuPass has used Putty Secure Copy Client (PSCP) to transfer data.[13]

G0049 OilRig

OilRig has used Putty to access compromised systems.[14]

G0106 Rocke

Rocke has spread its coinminer via SSH.[15]

G0139 TeamTNT

TeamTNT has used SSH to connect back to victim machines.[16] TeamTNT has also used SSH to transfer tools and payloads onto victim hosts and execute them.[17]

G0088 TEMP.Veles

TEMP.Veles has relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution.[18]

Mitigations

ID Mitigation Description
M1042 Disable or Remove Feature or Program

Disable the SSH daemon on systems that do not require it. For macOS ensure Remote Login is disabled under Sharing Preferences.[19]

M1032 Multi-factor Authentication

Require multi-factor authentication for SSH connections wherever possible, such as password protected SSH keys.

M1018 User Account Management

Limit which user accounts are allowed to login via SSH.

Detection

ID Data Source Data Component Detects
DS0028 Logon Session Logon Session Creation

Monitor for user accounts logged into systems that may use Valid Accounts to log into remote machines using Secure Shell (SSH). For example, on Linux systems SSH logon activity can be found in the logs located in /var/log/auth.log or /var/log/secure depending on the distro you are using.

For Linux systems, the Audit framework (auditd) can be used to monitor any writes to SSH log files that store information about logged in accounts such as /var/log/auth.log.

For macOS systems (10.12+), Unified Logs can be queried to show SSH daemon (sshd) messages that include information on logged in accounts. The following command-line can be used to query the last hour’s worth of unified logs in this manner: log show -info --debug --predicate 'processImagePath CONTAINS "sshd" AND eventMessage CONTAINS "Accepted"' --last 1h | grep sshd

DS0029 Network Traffic Network Connection Creation

Monitor for newly constructed network connections (typically port 22) that may use Valid Accounts to log into remote machines using Secure Shell (SSH). Use of SSH may be legitimate depending on the environment and how it’s used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with SSH.

Network Analysis Frameworks such as Zeek can be used to capture, decode, and alert on network traffic. Accordingly, they can be used to look for the creation of SSH network connections.

DS0009 Process Process Creation

Monitor for newly executed processes that may use Valid Accounts to log into remote machines using Secure Shell (SSH). For example, on macOS systems log show --predicate 'process = "sshd"' can be used to review incoming SSH connection attempts for suspicious activity. The command log show --info --predicate 'process = "ssh" or eventMessage contains "ssh"' can be used to review outgoing SSH connection activity.[19]

For Linux systems, the Audit framework (auditd) can be used to monitor for the creation of SSH related processes such as ssh.

For macOS systems (10.12+), the above command can be used to look through the Unified Logs for SSH connection activity, though we also recommend including the "—debug" parameter to ensure that all relevant data is returned: log show --info --debug --predicate 'process = "ssh" or eventMessage contains "ssh"'

References