Techniques › T1021 › T1021.004
T1021.004 SSH
lateral movement — ESXi, Linux, macOS · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
5
Sigma rules tagged attack.t1021.004
2
KEV CVEs mapped here
<p>Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.</p><p>SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via
vim-cmd hostsvc/enable_ssh) or via vCenter. The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user (i.e., SSH Authorized Keys).</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2025-32433 | Erlang Erlang/OTP | exploitation technique | Mapped | 2025-06-09 |
| CVE-2023-39780 | ASUS RT-AX55 Routers | secondary impact | Mapped | 2025-06-02 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0596 Behavioral Detection of Remote SSH Logins Followed by Post-Login Execution v1.0
AN1638 LinuxSSH login from a remote system (via sshd), followed by user context execution of suspicious binaries or privilege escalation behavior.Tunable:
TimeWindowSuspiciousProcessListUsernameFilterAN1639 macOSSSH login detected via Unified Logs, followed by unusual process execution, especially outside normal user behavior patterns.Tunable:TimeWindowUserContextCommandLineKeywordsAN1640 ESXiSSH login via hostd or/var/log/auth.log, followed by CLI access to host shell or file manipulation in restricted areas.Tunable:AllowedUsersTimeWindowCommandList
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1021.004
Author: Muhammad Faisal (@faisalusuf)
· 2024-02-25 · logsource: product=bitbucket service=audit · 16ab6143-510a-44e2-a615-bdb80b8317fc
Detects Bitbucket global SSH access configuration changes.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-12 (modified 2024-03-05) · logsource: product=windows category=process_creation · 327f48c1-a6db-4eb8-875a-f6981f1b0183
Detects port forwarding activity via SSH.exe
Author: mdecrevoisier
· 2022-10-25 · logsource: product=windows service=openssh · 3ce8e9a4-bc61-4c9b-8e69-d7e2492a8781
Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.
Author: @kostastsale
· 2026-02-19 · logsource: product=windows category=process_creation · 7f3a9c2d-4e8b-4a7f-9d3e-5c6f8a9b2e1d
Detects the OpenEDR ssh-shellhost.exe spawning a command shell (cmd.exe) or PowerShell with PTY (pseudo-terminal) capabilities.
This may indicate remote command execution through OpenEDR's remote management features, which could be legitimate administrative activity or potential abuse of the remote access tool.
Threat actors may leverage OpenEDR's remote shell capabilities to execute commands on compromised systems, facilitating lateral movement or other command-and-control operations.
Author: Muhammad Faisal (@faisalusuf)
· 2024-02-25 · logsource: product=bitbucket service=audit · d3f90469-fb05-42ce-b67d-0fded91bbef3
Detects SSH user login access failures.
Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field.
Rules tagged at the parent level (attack.t1021) 11
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 22777c9e-873a-4b49-855f-6072ab861a52
Detects instances where an SMB service on an OpenCanary node has had a file open request.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 6991bc2b-ae2e-447f-bc55-3a1ba04c14e5
Detects instances where an FTP service on an OpenCanary node has had a login attempt.
Author: omkar72
· 2020-10-30 (modified 2023-02-28) · logsource: product=windows category=process_creation · 730fc21b-eaff-474b-ad23-90fd265d4988
Detects user accept agreement execution in psexec commandline
Author: Chirag Damani
· 2026-03-29 · logsource: product=windows category=process_creation · 7638e5fe-600c-4289-a968-f49dd537ec7d
Detects execution of the hacktool NetExec.
NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration
In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems.
Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.
Author: Tim Rauch, Elastic (idea)
· 2022-09-27 · logsource: product=windows category=process_creation · 8a3038e8-9c9d-46f8-b184-66234a160f6f
Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.
Author: Tim Rauch, Elastic (idea)
· 2022-09-27 (modified 2022-12-30) · logsource: product=windows category=process_creation · 9bd04a79-dabe-4f1f-a5ff-92430265c96b
Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · 9db5446c-b44a-4291-8b89-fcab5609c3b3
Detects instances where a VNC service on an OpenCanary node has had a connection attempt.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · cd55f721-5623-4663-bd9b-5229cab5237d
Detects instances where an SSH service on an OpenCanary node has had a connection attempt.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · e9856028-fd4e-46e6-b3d1-10f7ceb95078
Detects instances where an SNMP service on an OpenCanary node has had an OID request.
Author: Josh Nickels
· 2024-05-10 · logsource: product=windows category=network_connection · fda34293-718e-4b36-b018-38caab0d1209
Detects an RDP connection originating from a domain controller.
Author: Security Onion Solutions
· 2024-03-08 · logsource: product=opencanary category=application · ff7139bc-fdb1-4437-92f2-6afefe8884cb
Detects instances where an SSH service on an OpenCanary node has had a login attempt.