Elastic low stable kql

Unusual SSHD Child Process

This rule detects the creation of an unusual SSHD child process through the usage of the "new_terms" rule type. Attackers may abuse SSH to maintain persistence on a compromised system, or to establish a backdoor for remote access, potentially resulting in an unusual SSHD child process being created.

View Source

Detection Logic

event.category:process and host.os.type:linux and event.type:start and event.action:(exec or ProcessRollup2) and
process.parent.name:sshd and process.args_count:2 and process.parent.args:"-D" and
not (
  process.command_line:(-bash or -zsh or -sh) or
  process.name:(ractrans or exectask or tty or tput or ferny-askpass or id or ip) or
  process.executable:/var/tmp/foreman-ssh-cmd*/script
)

Field Validations

Loading…

Comments (0)

Loading comments...