Remote Services: SSH
- ID
- T1021.004
- Tactics
- TA0008 Lateral Movement
- Sub-technique of
- T1021 Remote Services
- Platforms
- ESXi, Linux, macOS, Windows
- Data sources
- Process Creation, Logon Session Creation, Network Traffic Flow, Logon Session Metadata, Network Traffic Content, Command Execution
- Source
- attack.mitre.org
- MITRE last modified
- 18 Sep 2026
Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.
SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via vim-cmd hostsvc/enable_ssh) or via vCenter.[2][3][4] Modern versions of Windows include a built-in SSH server and client.[5] The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user (i.e., SSH Authorized Keys).
Detection
- DET0596 Behavioral Detection of Remote SSH Logins Followed by Post-Login Execution
Data components: Process Creation, Logon Session Creation, Network Traffic Flow, Logon Session Metadata, Network Traffic Content, Command Execution
Mitigations (3)
- M1018 User Account Management
Limit which user accounts are allowed to login via SSH.
- M1032 Multi-factor Authentication
Require multi-factor authentication for SSH connections wherever possible, such as password protected SSH keys.
- M1042 Disable or Remove Feature or Program
Disable the SSH daemon on systems that do not require it, especially ESXi servers. For macOS, ensure Remote Login is disabled under Sharing Preferences.[1]
Groups (19)
- G0032 Lazarus Group
- G0036 GCMAN
- G0045 menuPass
- G0046 FIN7
- G0049 OilRig
- G0065 Leviathan
- G0087 APT39
- G0098 BlackTech
- G0106 Rocke
- G0117 Fox Kitten
- G0119 Indrik Spider
- G0139 TeamTNT
- G0143 Aquatic Panda
- G1015 Scattered Spider
- G1016 FIN13
- G1023 APT5
- G1045 Salt Typhoon
- G1046 Storm-1811
- G1048 UNC3886
Software (5)
References
- Apple Unified Log Analysis Remote Login and Screen Sharing
- Sygnia ESXi Ransomware 2025
- TrendMicro ESXI Ransomware
- Sygnia Abyss Locker 2025
- Windows SSH