TA0008 · LATERAL MOVEMENT
SSH
Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.
Detect it with
Use of SSH may be legitimate depending on the environment and how it’s used. Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with SSH.
Why it matters on shift
SSH is one of the concrete ways adversaries achieve lateral movement. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After lateral movement, the next tactic is usually Collection. Search your telemetry for the transition before closing the ticket.
Kill-chain context