Remote Services: SSH
Other sub-techniques of Remote Services (6)
Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.
SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user.[1]
Procedure Examples
| Name | Description |
|---|---|
| APT39 |
APT39 used secure shell (SSH) to move laterally among their targets. [7] |
| Cobalt Strike |
Cobalt Strike can SSH to a remote service.[2] |
| Empire |
Empire contains modules for executing commands over SSH as well as in-memory VNC agent injection.[3] |
| GCMAN | |
| Leviathan | |
| menuPass |
menuPass has used Putty Secure Copy Client (PSCP) to transfer data.[6] |
| OilRig | |
| Rocke | |
| TEMP.Veles |
TEMP.Veles has relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution.[9] |
Mitigations
| Mitigation | Description |
|---|---|
| Disable or Remove Feature or Program |
Disable the SSH daemon on systems that do not require it. |
| Multi-factor Authentication |
Require multi-factor authentication for SSH connections wherever possible. |
| User Account Management |
Limit which user accounts are allowed to login via SSH. |
Detection
Use of SSH may be legitimate depending on the environment and how it’s used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with SSH. Monitor for user accounts logged into systems they would not normally access or access patterns to multiple systems over a relatively short period of time.
References
- SSH.COM. (n.d.). SSH (Secure Shell). Retrieved March 23, 2020.
- Cobalt Strike. (2017, December 8). Tactics, Techniques, and Procedures. Retrieved December 20, 2017.
- Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.
- Kaspersky Lab's Global Research & Analysis Team. (2016, February 8). APT-style bank robberies increase with Metel, GCMAN and Carbanak 2.0 attacks. Retrieved April 20, 2016.
- Unit 42. (2017, December 15). Unit 42 Playbook Viewer. Retrieved December 20, 2017.
- PwC and BAE Systems. (2017, April). Operation Cloud Hopper. Retrieved April 5, 2017.
- Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019.
- Plan, F., et all. (2019, March 4). APT40: Examining a China-Nexus Espionage Actor. Retrieved March 18, 2019.
- Miller, S, et al. (2019, April 10). TRITON Actor TTP Profile, Custom Attack Tools, Detections, and ATT&CK Mapping. Retrieved April 16, 2019.
- Anomali Labs. (2019, March 15). Rocke Evolves Its Arsenal With a New Malware Family Written in Golang. Retrieved April 24, 2019.