T1021.004sub-technique of T1021 Remote Services
SSH
ESXi · Linux · macOS1 piece on this siteT1021.004 on attack.mitre.org
Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Playbook for this stage
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
The evidence it leaves
Where the traces live, and what each source proves and does not.
Artifact reference
Linux authentication records
T1021.004
how MITRE says to see it
Behavioral Detection of Remote SSH Logins Followed by Post-Login Execution
- SSH login from a remote system (via sshd), followed by user context execution of suspicious binaries or privilege escalation behavior.
- SSH login detected via Unified Logs, followed by unusual process execution, especially outside normal user behavior patterns.
- SSH login via hostd or `/var/log/auth.log`, followed by CLI access to host shell or file manipulation in restricted areas.
what reduces it
- M1018 User Account Management. Limit which user accounts are allowed to login via SSH.
- M1032 Multi-factor Authentication. Require multi-factor authentication for SSH connections wherever possible, such as password protected SSH keys.
- M1042 Disable or Remove Feature or Program. Disable the SSH daemon on systems that do not require it, especially ESXi servers. For macOS, ensure Remote Login is disabled under Sharing Preferences.