Program Executed Using Proxy/Local Command Via SSH.EXE

Severity: medium
Author: frack113, Nasreddine Bencherchali
Source: upstream

Detect usage of the "ssh.exe" binary as a proxy to launch other programs.

MITRE ATT&CK coverage

Tactic	Techniques
Defense Evasion	`T1218` System Binary Proxy Execution

Event coverage

Provider	Event ID	Title
Sysmon	1	Process creation

Stages and Predicates

Stage 1: `selection_parent`

ParentImage: 'C:\Windows\System32\OpenSSH\sshd.exe'

Stage 2: `all of selection_cli_img`

or:
Hashes|contains: 'IMPHASH=27b0da080ef92afb37983d30d839141e'
Hashes|contains: 'IMPHASH=334d66c33503ccbf647c15b47c27eef4'
Hashes|contains: 'IMPHASH=3eaadce9ae43d5a918bb082065815c3b'
Hashes|contains: 'IMPHASH=55b4964d29aad5438b9e950052dbbbc0'
Hashes|contains: 'IMPHASH=5f959422308ac3d721010d66647e100e'
Hashes|contains: 'IMPHASH=977eb4c263d384e47daa0712d34713ab'
Hashes|contains: 'IMPHASH=980fe6cf0d996ab1eedf877222e722aa'
Hashes|contains: 'IMPHASH=a49aaa3d03d1cd9c8dc7fca60f7f480b'
Hashes|contains: 'IMPHASH=dd335f759b6d5d6a8382b71dd9d65791'
Image|endswith: '\ssh.exe'
Product: 'OpenSSH for Windows'

Stage 3: `all of selection_cli_flags`

or:
CommandLine|contains: ' LocalCommand'
CommandLine|contains: 'PermitLocalCommand=yes'
CommandLine|contains: 'ProxyCommand='

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

Field	Kind	Values
`CommandLine`	match	`LocalCommand` `PermitLocalCommand=yes` `ProxyCommand=`
`Hashes`	match	`IMPHASH=27b0da080ef92afb37983d30d839141e` `IMPHASH=334d66c33503ccbf647c15b47c27eef4` `IMPHASH=3eaadce9ae43d5a918bb082065815c3b` `IMPHASH=55b4964d29aad5438b9e950052dbbbc0` `IMPHASH=5f959422308ac3d721010d66647e100e` `IMPHASH=977eb4c263d384e47daa0712d34713ab` `IMPHASH=980fe6cf0d996ab1eedf877222e722aa` `IMPHASH=a49aaa3d03d1cd9c8dc7fca60f7f480b` `IMPHASH=dd335f759b6d5d6a8382b71dd9d65791`
`Image`	ends_with	`\ssh.exe` corpus 3 (sigma 3)
`ParentImage`	eq	`C:\Windows\System32\OpenSSH\sshd.exe`
`Product`	eq	`OpenSSH for Windows`