T1021.004 SSH — Attack Simulation

Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via `vim-cmd…

Technique description

No compatible procedure was found in the pinned Atomic index. This is a support gap, not a finding of technical impossibility.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

No compatible documented candidate in the pinned snapshot. This is a support gap, not technical impossibility.

Connected ecosystem references

Linked tags

cannot_simulate_yet subtechnique source_mapped

Detection and collection

T1021.004 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.