Remote Service Session Hijacking: SSH Hijacking `T1563.001`

Tactic: Lateral Movement

Adversaries may hijack a legitimate user's SSH session to move laterally within an environment. Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems. It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair.

Authoring guide

These 10 rules share fields, values, and exclusions.

Fields filtered most (17 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`event.type`	9	`eq` 7, `in` 2	`start`, `change`, `creation`
`EventType`	7	`eq` 4, `in` 3	`exec`, `ProcessRollup2`, `connection_attempted`, `creation`, `end`
`host.os.type`	7	`eq` 7
`process_name`	5	`in` 3, `eq` 1, `is_not_null` 1, `wildcard` 1	`curl`, `wget`, `.elf`, `.lua`, `.php*`
`Image`	3	`eq` 1, `starts_with` 1, `wildcard` 1	`./`, `./`, `/boot/`, `/boot/`, `/dev/shm/`
`event.category`	3	`eq` 3	`file`, `process`
`file.name`	3	`in` 2, `eq` 1	`authorized_keys`, `authorized_keys2`, `libkeyutils.so`
`parent_process_name`	3	`eq` 2, `in` 1	`sshd`, `ssh`
`CommandLine`	2	`contains` 1, `eq` 1	`/usr/sbin/sshd -D -R`, `github.com/hackerschoice/`, `gsocket.io/`, `nossl.segfault.net/`
`TargetFilename`	2	`in` 1, `wildcard` 1	`/etc/ssh/`, `/home//.ssh/`, `/root/.ssh/`, `/usr/bin/scp`, `/usr/bin/sftp`
`process.args`	2	`eq` 1, `starts_with` 1	`-c`, `http://nossl.segfault.net/`, `https://github.com/hackerschoice/`, `https://gsocket.io/`
`process.args_count`	2	`eq` 2	`1`, `2`
`ParentCommandLine`	1	`eq` 1	`/usr/sbin/sshd -D -R`, `sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups`
`ParentImage`	1	`eq` 1	`/usr/sbin/sshd`
`container.id`	1	`wildcard` 1	`*`

Top indicator values (107 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticPotential Execution via SSH Backdoor elasticPotential HackersChoice Tool Downloaded elasticPotential THC Tool Downloaded elasticUnusual SSH Parent/Child Execution elasticUnusual SSHD Child Process	6	1087
`EventType`	`eq`	`exec` elasticNetwork Connection Initiated by Suspicious SSHD Child Process elasticPotential Execution via SSH Backdoor elasticPotential HackersChoice Tool Downloaded elasticUnusual SSH Parent/Child Execution	4	579
`EventType`	`eq`	`connection_attempted` elasticNetwork Connection Initiated by Suspicious SSHD Child Process	1	75
`EventType`	`eq`	`end` elasticPotential Execution via SSH Backdoor	1	19
`EventType`	`in`	`exec` elasticPotential THC Tool Downloaded elasticUnusual SSHD Child Process	2	206
`EventType`	`in`	`ProcessRollup2` elasticPotential THC Tool Downloaded	1	118
`EventType`	`in`	`creation` elasticSSH Key Generated via ssh-keygen	1	34
`EventType`	`in`	`exec_event` elasticPotential THC Tool Downloaded	1	150
`EventType`	`in`	`executed` elasticPotential THC Tool Downloaded	1	98
`EventType`	`in`	`file_create_event` elasticSSH Key Generated via ssh-keygen	1	9
`EventType`	`in`	`process_started` elasticPotential THC Tool Downloaded	1	83
`EventType`	`in`	`processrollup2` elasticUnusual SSHD Child Process	1	9
`EventType`	`in`	`start` elasticPotential THC Tool Downloaded	1	168
`event.category`	`eq`	`file` elasticRenaming of OpenSSH Binaries elasticSSH Authorized Keys File Activity	2	43
`event.type`	`in`	`change` elasticSSH Authorized Key File Activity Detected via Defend for Containers elasticSSH Authorized Keys File Activity	2	20
`event.type`	`in`	`creation` elasticSSH Authorized Key File Activity Detected via Defend for Containers elasticSSH Authorized Keys File Activity	2	19
`file.name`	`in`	`authorized_keys` elasticSSH Authorized Key File Activity Detected via Defend for Containers elasticSSH Authorized Keys File Activity	2	3
`file.name`	`in`	`authorized_keys2` elasticSSH Authorized Key File Activity Detected via Defend for Containers elasticSSH Authorized Keys File Activity	2	3
`parent_process_name`	`eq`	`sshd` elasticPotential Execution via SSH Backdoor elasticUnusual SSHD Child Process	2	3
`process_name`	`in`	`curl` elasticPotential HackersChoice Tool Downloaded elasticPotential THC Tool Downloaded	2	90
`process_name`	`in`	`wget` elasticPotential HackersChoice Tool Downloaded elasticPotential THC Tool Downloaded	2	47
`CommandLine`	`contains`	`github.com/hackerschoice/` elasticPotential HackersChoice Tool Downloaded	1
`CommandLine`	`contains`	`gsocket.io/` elasticPotential HackersChoice Tool Downloaded	1
`CommandLine`	`contains`	`nossl.segfault.net/` elasticPotential HackersChoice Tool Downloaded	1
`CommandLine`	`contains`	`thc.org/` elasticPotential HackersChoice Tool Downloaded	1
`CommandLine`	`eq`	`/usr/sbin/sshd -D -R` elasticPotential Execution via SSH Backdoor	1
`Image`	`eq`	`/usr/bin/ssh-keygen` elasticSSH Key Generated via ssh-keygen	1
`Image`	`starts_with`	`./` elasticNetwork Connection Initiated by Suspicious SSHD Child Process	1	26
`Image`	`starts_with`	`/boot/` elasticNetwork Connection Initiated by Suspicious SSHD Child Process	1	28
`Image`	`starts_with`	`/dev/shm/` elasticNetwork Connection Initiated by Suspicious SSHD Child Process	1	53

Exclusions (145 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`CommandLine`	`contains`	`ansible` elasticNetwork Connection Initiated by Suspicious SSHD Child Process	1
`CommandLine`	`contains`	`become-success` elasticNetwork Connection Initiated by Suspicious SSHD Child Process	1
`CommandLine`	`eq`	`true` elasticUnusual SSH Parent/Child Execution	1
`CommandLine`	`in`	`-bash` elasticUnusual SSHD Child Process	1
`CommandLine`	`in`	`-sh` elasticUnusual SSHD Child Process	1
`CommandLine`	`in`	`-zsh` elasticUnusual SSHD Child Process	1
`CommandLine`	`wildcard`	`BECOME-SUCCESS` elasticPotential Execution via SSH Backdoor	1
`CommandLine`	`wildcard`	`ansible` elasticPotential Execution via SSH Backdoor	1
`CommandLine`	`wildcard`	`sh -c -- /usr/bin/env -i PATH=*` elasticPotential Execution via SSH Backdoor	1
`CommandLine`	`wildcard`	`sh -c /usr/bin/env -i PATH=*` elasticPotential Execution via SSH Backdoor	1
`Image`	`eq`	`/home/sa-ansible` elasticRenaming of OpenSSH Binaries	1
`Image`	`eq`	`/library/developer/commandlinetools/usr/bin/git` elasticSSH Authorized Keys File Activity	1
`Image`	`eq`	`/opt/jc/bin/jumpcloud-agent` elasticSSH Authorized Keys File Activity	1
`Image`	`eq`	`/opt/puppetlabs/puppet/bin/puppet` elasticSSH Authorized Keys File Activity	1
`Image`	`eq`	`/usr/bin/bsdtar` elasticSSH Authorized Keys File Activity	1

Rules under this technique

These vendors publish rules tagged with this technique.