Techniques › T1563.001 › AN0710
AN0710 Analytic 0710
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Suspicious reuse of SSH agent sockets across multiple users or processes, anomalous access to ~/.ssh/ or /tmp/ssh-* sockets, and abnormal patterns of lateral movement via SSH without new authentication events. Defender view: detect when one process accesses another user's SSH agent or when an existing SSH connection is used to pivot unexpectedly.</p>
- Detects
- T1563.001 SSH Hijacking
- Part of
- DET0256 Detection Strategy for SSH Session Hijacking
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | open or connect syscalls on /tmp/ssh-* or $SSH_AUTH_SOCK | DC0082 Network Connection Creation |
| auditd:EXECVE | Execution of ssh/scp/sftp without corresponding authentication log | DC0032 Process Creation |
| NSM:Connections | Missing new login event but session activity continues | DC0067 Logon Session Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
UserContext | Tune alerts for cross-user access to SSH agent sockets. |
TimeWindow | Correlate lack of authentication with lateral SSH activity within a short timeframe. |