T1021.004Lateral Movement
SSH
Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either…
CVEs3
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.3
Reports1
Detections
5 Sigma rules tagged T1021.004SSHT1021.0045 general rules
- Bitbucket Global SSH Settings Changedmediumtest
- Bitbucket User Login Failure Via SSHmediumtest
- OpenSSH Server Listening On Socketmediumtest
- Port Forwarding Activity Via SSH.EXEmediumtest
- OpenEDR Spawning Command Shellmediumexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to SSH
3 CVEs, by priority. Each link shows its badge.- CVE-2025-32433Erlang Erlang/OTP SSH Server Missing Authentication for Critical Function VulnerabilityErlang · Erlang/OTPKEVPublic exploitCritical · 10.0T1059Command and Scripting InterpreterT1021.004SSHMITRE CTID mapping of the KEV entry · how it is exploited98.9%Top 0.07%80.0priority
- CVE-2015-7755Juniper ScreenOS Improper Authentication VulnerabilityAI mapping from the description · primary impact61.1%Top 0.84%69.7priority
- CVE-2023-39780ASUS RT-AX55 Routers OS Command Injection VulnerabilityMITRE CTID mapping of the KEV entry · follow-on activity39.5%Top 1.4%68.9priority