OpenSSH Server (sshd) Listening on SSH Socket on Windows

ATT&CK techniques

Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1021.004SSH
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies when the OpenSSH server process (sshd) emits an event indicating it has begun listening on an SSH socket. Attackers may enable or start an SSH service to establish remote access, so the listener state is a key indicator of new network-facing exposure. Detection relies on Windows OpenSSH service telemetry with Event ID 4 and an ssld log payload that starts with the exact listening message.

Reporting behind it

Related detections9 linkedT1021.004 — drag to rearrange

Malicious Bad Apples Remote Apple Events Lateral Movement via osascript

Suspicious OpenSSH Reverse Tunnel Over HTTPS Port (Chaos Ransomware)

Suspicious Automated SSH Lateral Movement with Batch Mode (via process_creation)

OpenSSH Native Server Feature Installation (via powershell)

OpenSSH Server Listening on Socket (via openssh)

Suspicious macOS SSH Loopback Connection for TCC Bypass

Suspicious sshpass Noninteractive SSH Password Authentication (via process_creation)

Suspicious SimpleHelp Remote Access Client Spawning Discovery Commands (via process_creation)

OpenEDR ssh-shellhost Spawning Cmd or PowerShell With PTY on Windows

OpenSSH Server (sshd) Listening on SSH Socket on Windows

Pivot detection · T1021.004 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-openssh-server-starts-listening-on-ssh-socket-3ce8e9a4

title: OpenSSH Server (sshd) Listening on SSH Socket on Windows
id: 64962fc4-549a-498f-b41f-f08deac7897a
status: test
description: This rule identifies when the OpenSSH server process (sshd) emits an event indicating it has begun listening on an SSH socket. Attackers may enable or start an SSH service to establish remote access, so the listener state is a key indicator of new network-facing exposure. Detection relies on Windows OpenSSH service telemetry with Event ID 4 and an ssld log payload that starts with the exact listening message.
references:
  - https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0008-Lateral%20Movement/T1021.004-Remote%20Service%20SSH
  - https://winaero.com/enable-openssh-server-windows-10/
  - https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse
  - https://virtualizationreview.com/articles/2020/05/21/ssh-server-on-windows-10.aspx
  - https://medium.com/threatpunter/detecting-adversary-tradecraft-with-image-load-event-logging-and-eql-8de93338c16
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/openssh/win_sshd_openssh_server_listening_on_socket.yml
author: mdecrevoisier, Huntrule Team
date: 2022-10-25
tags:
  - attack.lateral-movement
  - attack.t1021.004
logsource:
  product: windows
  service: openssh
detection:
  selection:
    EventID: 4
    process: sshd
    payload|startswith: "Server listening on "
  condition: selection
falsepositives:
  - Legitimate administrator activity
level: medium
license: DRL-1.1
related:
  - id: 3ce8e9a4-bc61-4c9b-8e69-d7e2492a8781
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL