OpenEDR ssh-shellhost Spawning Cmd or PowerShell With PTY on Windows

title: OpenEDR ssh-shellhost Spawning Cmd or PowerShell With PTY on Windows
id: 6bc3c15c-16e2-45a7-9fde-1ad6205241be
status: experimental
description: This rule matches Windows process creation where ITSMService.exe launches ssh-shellhost.exe with a command line containing '--pty', and the spawned command line contains 'cmd', 'powershell', or 'pwsh' (as well as 'bash'). The behavior is significant because PTY-backed remote shell capabilities can be used to execute arbitrary commands and enable follow-on actions like lateral movement or command-and-control. It relies on process creation telemetry that includes parent process image/path and the full command line of the spawned process.
author: "@kostastsale, Huntrule Team"
date: 2026-02-19
references:
  - https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_comodo_ssh_shellhost_cmd_spawn.yml
tags:
  - attack.execution
  - attack.t1059.003
  - attack.lateral-movement
  - attack.t1021.004
  - attack.command-and-control
  - attack.t1219
logsource:
  product: windows
  category: process_creation
detection:
  selection_img:
    ParentImage|endswith: \ITSMService.exe
    Image|endswith: \ssh-shellhost.exe
    CommandLine|contains: --pty
  selection_cli_shell:
    CommandLine|contains:
      - bash
      - cmd
      - powershell
      - pwsh
  condition: all of selection_*
falsepositives:
  - Legitimate use of OpenEDR for remote command execution
level: medium
license: DRL-1.1
related:
  - id: 7f3a9c2d-4e8b-4a7f-9d3e-5c6f8a9b2e1d
    type: derived