attack.t1021.004

OpenEDR Spawning Command Shell

Feb 28, 2026 · attack.execution attack.t1059.003 attack.lateral-movement attack.t1021.004 attack.command-and-control attack.t1219 ·

Share on:

Detects the OpenEDR ssh-shellhost.exe spawning a command shell (cmd.exe) or PowerShell with PTY (pseudo-terminal) capabilities. This may indicate remote command execution through OpenEDR's remote management features, which could be legitimate administrative activity or potential abuse of the remote access tool. Threat actors may leverage OpenEDR's remote shell capabilities to execute commands on compromised systems, facilitating lateral movement or other command-and-control operations.

Bitbucket Global SSH Settings Changed

Nov 3, 2025 · attack.lateral-movement attack.defense-evasion attack.t1562.001 attack.t1021.004 ·

Share on:

Detects Bitbucket global SSH access configuration changes.

Bitbucket User Login Failure Via SSH

Nov 3, 2025 · attack.lateral-movement attack.credential-access attack.t1021.004 attack.t1110 ·

Share on:

Detects SSH user login access failures. Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field.

Port Forwarding Activity Via SSH.EXE

Aug 28, 2025 · attack.command-and-control attack.lateral-movement attack.t1572 attack.t1021.001 attack.t1021.004 ·

Share on:

Detects port forwarding activity via SSH.exe

OpenSSH Server Listening On Socket

Aug 12, 2024 · attack.lateral-movement attack.t1021.004 ·

Share on:

Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.