Elastic low stable eql

Potential OpenSSH Backdoor Logging Activity

Identifies a Secure Shell (SSH) client or server process creating a known SSH backdoor log file. Adversaries may modify SSH related binaries for persistence or credential access via patching sensitive functions to enable unauthorized access or to log SSH credentials for exfiltration.

View Source

Detection Logic

file where host.os.type == "linux" and event.type == "creation" and process.name in ("ssh", "sshd") and
  (
    (
      file.name : (".*", "~*", "*~") and not file.name : (
        ".cache", ".viminfo", ".bash_history", ".google_authenticator", ".jelenv", ".csvignore", ".rtreport", ".git*"
      )
    ) or
    file.extension : ("in", "out", "ini", "h", "gz", "so", "sock", "sync", "0", "1", "2", "3", "4", "5", "6", "7", "8", "9") or
    file.path :
    (
      "/tmp/*",
      "/var/tmp/*",
      "/dev/shm/*",
      "/usr/share/*",
      "/usr/include/*",
      "/usr/local/include/*",
      "/usr/share/man/*",
      "/usr/local/share/*",
      "/usr/lib/*.so.*",
      "/usr/bin/ssd",
      "/var/run/sshd/sshd.pid",
      "/var/run/nscd/ns.pid",
      "/var/run/udev/ud.pid",
      "/var/run/udevd.pid"
    )
  ) and
  not file.path like ("/tmp/krb5cc*", "/tmp/ansible_*", "/storage/*", "/tmp/clearsigned.message.*", "/var/sftp/refinitiv/*", "/tmp/fileutil.message.*")

False Positives

⚠ Updates to approved and trusted SSH executables can trigger this rule.

Field Validations

Loading…

Comments (0)

Loading comments...