OpenEDR ssh-shellhost Spawning Cmd or PowerShell With PTY on Windows
Alerts when OpenEDR ssh-shellhost.exe starts cmd.exe or PowerShell with --pty from under ITSMService.exe.
- Product
- windows
- Category
- process_creation
- Author
- @kostastsale (SigmaHQ), DRL 1.1
- Published
- 2026-02-19
- Updated
- 2026-07-31
ATT&CK techniques
Execution → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule matches Windows process creation where ITSMService.exe launches ssh-shellhost.exe with a command line containing '--pty', and the spawned command line contains 'cmd', 'powershell', or 'pwsh' (as well as 'bash'). The behavior is significant because PTY-backed remote shell capabilities can be used to execute arbitrary commands and enable follow-on actions like lateral movement or command-and-control. It relies on process creation telemetry that includes parent process image/path and the full command line of the spawned process.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: OpenEDR ssh-shellhost Spawning Cmd or PowerShell With PTY on Windows
id: 6bc3c15c-16e2-45a7-9fde-1ad6205241be
status: experimental
description: This rule matches Windows process creation where ITSMService.exe launches ssh-shellhost.exe with a command line containing '--pty', and the spawned command line contains 'cmd', 'powershell', or 'pwsh' (as well as 'bash'). The behavior is significant because PTY-backed remote shell capabilities can be used to execute arbitrary commands and enable follow-on actions like lateral movement or command-and-control. It relies on process creation telemetry that includes parent process image/path and the full command line of the spawned process.
author: "@kostastsale, Huntrule Team"
date: 2026-02-19
references:
- https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_comodo_ssh_shellhost_cmd_spawn.yml
tags:
- attack.execution
- attack.t1059.003
- attack.lateral-movement
- attack.t1021.004
- attack.command-and-control
- attack.t1219
logsource:
product: windows
category: process_creation
detection:
selection_img:
ParentImage|endswith: \ITSMService.exe
Image|endswith: \ssh-shellhost.exe
CommandLine|contains: --pty
selection_cli_shell:
CommandLine|contains:
- bash
- cmd
- powershell
- pwsh
condition: all of selection_*
falsepositives:
- Legitimate use of OpenEDR for remote command execution
level: medium
license: DRL-1.1
related:
- id: 7f3a9c2d-4e8b-4a7f-9d3e-5c6f8a9b2e1d
type: derived