OpenEDR ssh-shellhost.exe Spawning cmd.exe or PowerShell with PTY on Windows

title: OpenEDR ssh-shellhost.exe Spawning cmd.exe or PowerShell with PTY on Windows
id: 6bc3c15c-16e2-45a7-9fde-1ad6205241be
status: experimental
description: This rule flags process creation where OpenEDR's ssh-shellhost.exe (invoked under ITSMService.exe) launches a command-line shell and includes the PTY flag in its arguments. Shell spawning from a remote access component is security-relevant because it can enable remote command execution for administration or potential abuse. The detection relies on Windows process creation telemetry capturing parent image, child image, and command-line arguments.
author: "@kostastsale, Huntrule Team"
date: 2026-02-19
references:
  - https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_comodo_ssh_shellhost_cmd_spawn.yml
tags:
  - attack.execution
  - attack.t1059.003
  - attack.lateral-movement
  - attack.t1021.004
  - attack.command-and-control
  - attack.t1219
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    ParentImage|endswith: \ITSMService.exe
    Image|endswith: \ssh-shellhost.exe
    CommandLine|contains: --pty
  selection_cli_shell:
    CommandLine|contains:
      - bash
      - cmd
      - powershell
      - pwsh
  condition: all of selection_*
falsepositives:
  - Legitimate use of OpenEDR for remote command execution
level: medium
license: DRL-1.1
related:
  - id: 7f3a9c2d-4e8b-4a7f-9d3e-5c6f8a9b2e1d
    type: derived