Suspicious OpenEDR Spawning Command Shell (via process_creation)

title: Suspicious OpenEDR Spawning Command Shell (via process_creation)
id: cccb2795-3156-5b40-9f27-12c1c8d6f743
status: stable
description: This rule detects the OpenEDR ssh-shellhost.exe spawning a command shell (cmd.exe) or PowerShell with PTY (pseudo-terminal) capabilities. This may indicate remote command execution through OpenEDR's remote management features, which could be legitimate administrative behavior or potential misuse of the remote access tool. Threat actors may abuse OpenEDR's remote shell capabilities to execute commands on compromised systems, facilitating lateral movement or other command-and-control operations.
author: 'Huntrule Team'
date: 2026-06-12
references:
    - https://attack.mitre.org/techniques/T1219/
    - https://attack.mitre.org/techniques/T1021/004/
    - https://attack.mitre.org/techniques/T1059/003/
    - https://kostas-ts.medium.com/detecting-abuse-of-openedrs-permissive-edr-trial-a-security-researcher-s-perspective-fc55bf53972c
tags:
    - attack.execution
    - attack.t1059.003
    - attack.lateral-movement
    - attack.t1021.004
    - attack.command-and-control
    - attack.t1219
logsource:
    product: windows
    category: process_creation
detection:
    selection_img:
        ParentImage|endswith: '\ITSMService.exe'
        Image|endswith: '\ssh-shellhost.exe'
        CommandLine|contains: '--pty'
    selection_cli_shell:
        CommandLine|contains:
            - 'bash'
            - 'cmd'
            - 'powershell'
            - 'pwsh'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium