T1021.004 SSH — Detection Rules

Source-backed rule directory

• Bitbucket Global SSH Settings Changed · test · medium · {"product":"bitbucket","service":"audit","definition":"Requirements: \"Advance\" log level is required to receive these audit events."}
• Bitbucket User Login Failure Via SSH · test · medium · {"product":"bitbucket","service":"audit","definition":"Requirements: \"Advance\" log level is required to receive these audit events."}
• OpenSSH Server Listening On Socket · test · medium · {"product":"windows","service":"openssh"}
• OpenEDR Spawning Command Shell · experimental · medium · {"product":"windows","category":"process_creation"}
• Port Forwarding Activity Via SSH.EXE · test · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1021.004 SSH

MATCH(successful_ssh_login) AND source_host NOT_IN approved_ssh_sources -> ALERT

• Linux Authentication Logs
• Network Flow Logs
• Atlas source section

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0596 Behavioral Detection of Remote SSH Logins Followed by Post-Login Execution

AN1638 Analytic 1638

SSH login from a remote system (via sshd), followed by user context execution of suspicious binaries or privilege escalation behavior.

AN1639 Analytic 1639

SSH login detected via Unified Logs, followed by unusual process execution, especially outside normal user behavior patterns.

AN1640 Analytic 1640

SSH login via hostd or `/var/log/auth.log`, followed by CLI access to host shell or file manipulation in restricted areas.