Linux: SSH used to invoke a shell via ProxyCommand and embedded local command options

title: "Linux: SSH used to invoke a shell via ProxyCommand and embedded local command options"
id: 6342510b-c674-429d-b054-b8fddef1be77
status: test
description: This rule identifies process executions where the ssh binary (ending with /ssh) is used with command-line patterns indicating shell invocation through ProxyCommand-related options and local command settings. It also matches common interactive shell binaries and redirection patterns included in the ssh command line. Such activity can be used to execute unauthorized commands or to bypass restrictions by causing ssh to spawn a shell, and it relies on Linux process creation telemetry containing the process image path and full command line.
references:
  - https://gtfobins.github.io/gtfobins/ssh/
  - https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_ssh_shell_execution.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule Team
date: 2024-08-29
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: /ssh
    CommandLine|contains:
      - ProxyCommand=;
      - permitlocalcommand=yes
      - localhost
  selection_cli:
    CommandLine|contains:
      - /bin/bash
      - /bin/dash
      - /bin/fish
      - /bin/sh
      - /bin/zsh
      - sh 0<&2 1>&2
      - sh 1>&2 0<&2
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8737b7f6-8df3-4bb7-b1da-06019b99b687
    type: derived