Skip to content

Hide Navigation Hide TOC

ssh (7b607493-5035-4e29-9f95-55362f53b805)

This object contains information sourced from the Living Off The Land Binaries, Scripts and Libraries (LOLBAS) project, which is licensed under GNU General Public License v3.0.

Description: Ssh.exe is the OpenSSH compatible client can be used to connect to Windows 10 (build 1809 and later) and Windows Server 2019 devices.

Author: Akshat Pradhan

Paths: * c:\windows\system32\OpenSSH\ssh.exe

Resources: * https://gtfobins.github.io/gtfobins/ssh/

Detection: * Sigma: proc_creation_win_lolbin_ssh.yml * IOC: Event ID 4624 with process name C:\Windows\System32\OpenSSH\sshd.exe. * IOC: command line arguments specifying execution.[ssh.exe - LOLBAS Project]

Cluster A Galaxy A Cluster B Galaxy B Level
UNC3886 (23af694a-11f4-43eb-a176-683059b301cb) Tidal Groups ssh (7b607493-5035-4e29-9f95-55362f53b805) Tidal Software 1
APT28 (5b1a5b9e-4722-41fc-a15d-196a549e3ac5) Tidal Groups ssh (7b607493-5035-4e29-9f95-55362f53b805) Tidal Software 1