OpenEDR ssh-shellhost Spawning Cmd or PowerShell With PTY on Windows

Alerts when OpenEDR ssh-shellhost.exe starts cmd.exe or PowerShell with --pty from under ITSMService.exe.

FreeReviewedSigma · Medium · v2

Product: windows
Category: process_creation
Author: @kostastsale (SigmaHQ), DRL 1.1
Published: 2026-02-19
Updated: 2026-07-31

ATT&CK techniques

Execution → C2

Recon
Resource Dev
Initial Access
Execution
- T1059.003Windows Command Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1021.004SSH
Collection
C2
- T1219Remote Access Tools
Exfiltration
Impact

What it detects

This rule matches Windows process creation where ITSMService.exe launches ssh-shellhost.exe with a command line containing '--pty', and the spawned command line contains 'cmd', 'powershell', or 'pwsh' (as well as 'bash'). The behavior is significant because PTY-backed remote shell capabilities can be used to execute arbitrary commands and enable follow-on actions like lateral movement or command-and-control. It relies on process creation telemetry that includes parent process image/path and the full command line of the spawned process.

Reporting behind it

Related detections9 linkedT1219 — drag to rearrange

Malicious Bad Apples Remote Apple Events Lateral Movement via osascript

Suspicious n8n Campaign RMM Installer Masquerading as OneDrive Document

Suspicious Velociraptor Agent Deployment via msiexec From Cloud Storage

Suspicious OpenSSH Reverse Tunnel Over HTTPS Port (Chaos Ransomware)

Malicious Scheduled Task Masquerading as GoogleUpdate Launching SSH Reverse Shell

Malicious NetSupport RAT Client32 Execution

Possible AnyDesk RMM Silent MSI Installation via Windows Installer (via process_creation)

Suspicious Outbound Connection To MoonPeak C2 High Ports

Suspicious Remote Management C2 Subdomain Resolution

OpenEDR ssh-shellhost Spawning Cmd or PowerShell With PTY on Windows

Pivot detection · T1219 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

openedr-ssh-shellhost-exe-spawning-cmd-exe-or-powershell-with-pty-on-windows-7f3a9c2d

title: OpenEDR ssh-shellhost Spawning Cmd or PowerShell With PTY on Windows
id: 6bc3c15c-16e2-45a7-9fde-1ad6205241be
status: experimental
description: This rule matches Windows process creation where ITSMService.exe launches ssh-shellhost.exe with a command line containing '--pty', and the spawned command line contains 'cmd', 'powershell', or 'pwsh' (as well as 'bash'). The behavior is significant because PTY-backed remote shell capabilities can be used to execute arbitrary commands and enable follow-on actions like lateral movement or command-and-control. It relies on process creation telemetry that includes parent process image/path and the full command line of the spawned process.
author: "@kostastsale, Huntrule Team"
date: 2026-02-19
references:
  - https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_comodo_ssh_shellhost_cmd_spawn.yml
tags:
  - attack.execution
  - attack.t1059.003
  - attack.lateral-movement
  - attack.t1021.004
  - attack.command-and-control
  - attack.t1219
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    ParentImage|endswith: \ITSMService.exe
    Image|endswith: \ssh-shellhost.exe
    CommandLine|contains: --pty
  selection_cli_shell:
    CommandLine|contains:
      - bash
      - cmd
      - powershell
      - pwsh
  condition: all of selection_*
falsepositives:
  - Legitimate use of OpenEDR for remote command execution
level: medium
license: DRL-1.1
related:
  - id: 7f3a9c2d-4e8b-4a7f-9d3e-5c6f8a9b2e1d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL