Linux: SSH ProxyCommand Triggering Interactive Shell Execution
Flags Linux ssh invocations that embed shell execution and redirection via ProxyCommand/local command options.
- Product
- linux
- Category
- process_creation
- Author
- Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) (SigmaHQ), DRL 1.1
- Published
- 2024-08-29
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions where the ssh binary is invoked with command-line arguments consistent with proxying and local command permission. It further matches accompanying shell invocations (e.g., bash/dash/fish/sh/zsh) or redirection patterns that indicate an interactive or spawned shell. Such behavior can enable unauthorized command execution or help an attacker break out of restricted environments, and it relies on Linux process creation telemetry with Image and CommandLine fields.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Linux: SSH ProxyCommand Triggering Interactive Shell Execution"
id: 6342510b-c674-429d-b054-b8fddef1be77
status: test
description: This rule identifies process executions where the ssh binary is invoked with command-line arguments consistent with proxying and local command permission. It further matches accompanying shell invocations (e.g., bash/dash/fish/sh/zsh) or redirection patterns that indicate an interactive or spawned shell. Such behavior can enable unauthorized command execution or help an attacker break out of restricted environments, and it relies on Linux process creation telemetry with Image and CommandLine fields.
references:
- https://gtfobins.github.io/gtfobins/ssh/
- https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_ssh_shell_execution.yml
author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.), Huntrule Team
date: 2024-08-29
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith: /ssh
CommandLine|contains:
- ProxyCommand=;
- permitlocalcommand=yes
- localhost
selection_cli:
CommandLine|contains:
- /bin/bash
- /bin/dash
- /bin/fish
- /bin/sh
- /bin/zsh
- sh 0<&2 1>&2
- sh 1>&2 0<&2
condition: all of selection_*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 8737b7f6-8df3-4bb7-b1da-06019b99b687
type: derived