Windows OpenSSH Server starts listening on SSH socket

Flags OpenSSH (sshd) events showing the SSH server has started listening on a socket.

FreeUnreviewedSigmamediumv1

windows-openssh-server-starts-listening-on-ssh-socket-3ce8e9a4

title: Windows OpenSSH Server starts listening on SSH socket
id: 64962fc4-549a-498f-b41f-f08deac7897a
status: test
description: This rule identifies cases where the OpenSSH server (sshd) emits an event indicating it is “Server listening on …”, reflecting the moment the server begins listening on an SSH socket. Attackers may enable or start SSH services to establish remote interactive access or lateral movement paths. The detection relies on Windows OpenSSH service telemetry capturing EventID 4, matching the sshd process and the specific “Server listening on ” message prefix.
references:
  - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH
  - https://winaero.com/enable-openssh-server-windows-10/
  - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
  - https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx
  - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/openssh/win_sshd_openssh_server_listening_on_socket.yml
author: mdecrevoisier, Huntrule Team
date: 2022-10-25
tags:
  - attack.lateral-movement
  - attack.t1021.004
logsource:
  product: windows
  service: openssh
detection:
  selection:
    EventID: 4
    process: sshd
    payload|startswith: "Server listening on "
  condition: selection
falsepositives:
  - Legitimate administrator activity
level: medium
license: DRL-1.1
related:
  - id: 3ce8e9a4-bc61-4c9b-8e69-d7e2492a8781
    type: derived

What it detects

This rule identifies cases where the OpenSSH server (sshd) emits an event indicating it is “Server listening on …”, reflecting the moment the server begins listening on an SSH socket. Attackers may enable or start SSH services to establish remote interactive access or lateral movement paths. The detection relies on Windows OpenSSH service telemetry capturing EventID 4, matching the sshd process and the specific “Server listening on ” message prefix.

Known false positives

Legitimate administrator activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.