Elastic high stable eql

Proxy Execution via Windows OpenSSH

Identifies attempts to execute commands via proxy using the Windows OpenSSH client. This may indicate an attempt to bypass application control via trusted Windows binaries.

View Source

Detection Logic

process where host.os.type == "windows" and event.type == "start" and process.name : ("ssh.exe", "sftp.exe") and
  process.command_line : (
    "*Command=*powershell*", "*schtasks*", "*Command=*@echo off*", "*Command=*http*",
    "*Command=*mshta*", "*Command=*msiexec*", "*Command=*cmd /c*", "*Command=*cmd.exe*",
    "*Command=\"cmd /c*", "*LocalCommand=scp*&&*", "*LocalCommand=?scp*&&*", "*Command=*script*"
  )

Field Validations

Loading…

Comments (0)

Loading comments...