{"id":"7d6d30b8-5b91-4b90-a891-46cccaf29598","title":"Program Executed Using Proxy/Local Command Via SSH.EXE","description":"Detect usage of the \"ssh.exe\" binary as a proxy to launch other programs.","author":"frack113, Nasreddine Bencherchali","status":"test","level":"medium","date":"2022-12-29","modified":"2025-10-16","tags":["attack.stealth","attack.t1218"],"technique_ids":["T1218"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate usage for administration purposes"],"references":["https://lolbas-project.github.io/lolbas/Binaries/Ssh/","https://github.com/LOLBAS-Project/LOLBAS/pull/211/files","https://gtfobins.github.io/gtfobins/ssh/","https://man.openbsd.org/ssh_config#ProxyCommand","https://man.openbsd.org/ssh_config#LocalCommand"],"source_path":"rules/windows/process_creation/proc_creation_win_ssh_proxy_execution.yml","source_sha256":"2ecd2ff9d78ab26c163a14c033c910bc76455c236ec1feaf6c095e258bc0ec42","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_ssh_proxy_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Program Executed Using Proxy/Local Command Via SSH.EXE\nid: 7d6d30b8-5b91-4b90-a891-46cccaf29598\nstatus: test\ndescription: Detect usage of the \"ssh.exe\" binary as a proxy to launch other programs.\nreferences:\n    - https://lolbas-project.github.io/lolbas/Binaries/Ssh/\n    - https://github.com/LOLBAS-Project/LOLBAS/pull/211/files\n    - https://gtfobins.github.io/gtfobins/ssh/\n    - https://man.openbsd.org/ssh_config#ProxyCommand\n    - https://man.openbsd.org/ssh_config#LocalCommand\nauthor: frack113, Nasreddine Bencherchali\ndate: 2022-12-29\nmodified: 2025-10-16\ntags:\n    - attack.stealth\n    - attack.t1218\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_parent:\n        # ParentCommandLine: '\"C:\\Windows\\System32\\OpenSSH\\sshd.exe\" -R'\n        ParentImage: 'C:\\Windows\\System32\\OpenSSH\\sshd.exe'\n    selection_cli_img:\n        - Image|endswith: '\\ssh.exe'\n        - Product: 'OpenSSH for Windows'\n        - Hashes|contains:\n              - 'IMPHASH=55b4964d29aad5438b9e950052dbbbc0'\n              - 'IMPHASH=334d66c33503ccbf647c15b47c27eef4'\n              - 'IMPHASH=27b0da080ef92afb37983d30d839141e'\n              - 'IMPHASH=977eb4c263d384e47daa0712d34713ab'\n              - 'IMPHASH=3eaadce9ae43d5a918bb082065815c3b'\n              - 'IMPHASH=980fe6cf0d996ab1eedf877222e722aa'\n              - 'IMPHASH=5f959422308ac3d721010d66647e100e'\n              - 'IMPHASH=a49aaa3d03d1cd9c8dc7fca60f7f480b'\n              - 'IMPHASH=dd335f759b6d5d6a8382b71dd9d65791'\n    selection_cli_flags:\n        - CommandLine|contains: 'ProxyCommand='\n        - CommandLine|contains|all:\n              - 'PermitLocalCommand=yes'\n              - ' LocalCommand'\n    condition: selection_parent or all of selection_cli_*\nfalsepositives:\n    - Legitimate usage for administration purposes\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"}],"data_path":"data/detection-rules/7d6d30b8-5b91-4b90-a891-46cccaf29598.json","kind":"sigma"}