attack.t1021.004

Bitbucket Global SSH Settings Changed

Aug 12, 2024 · attack.lateral-movement attack.defense-evasion attack.t1562.001 attack.t1021.004 ·

Detects Bitbucket global SSH access configuration changes.

Bitbucket User Login Failure Via SSH

Aug 12, 2024 · attack.t1021.004 attack.t1110 ·

Detects SSH user login access failures. Please note that this rule can be noisy and is recommended to use with correlation based on "author.name" field.

OpenSSH Server Listening On Socket

Aug 12, 2024 · attack.lateral-movement attack.t1021.004 ·

Share on:

Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.

Port Forwarding Activity Via SSH.EXE

Aug 12, 2024 · attack.command-and-control attack.lateral-movement attack.t1572 attack.t1021.001 attack.t1021.004 ·

Share on:

Detects port forwarding activity via SSH.exe