tfMITRE ATT&CK sub-technique

SSH T1021.004

Tactic: Lateral Movement
Platforms: ESXi, Linux, macOS
Version: 1.3
Created: 11 February 2020
Last modified: 12 May 2026
Contributor: Janantha Marasinghe

Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsTop 9%

Threat groups91st percentile · 91% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsTop 12%

Campaigns88th percentile · 88% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware66th pct

Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 18%

Detection rules82nd percentile · 82% of ATT&CK techniques have this many detection rules written or fewer.

SSH MITRE reference T1021.004

Top 9%of all ATT&CK techniques for number of groups

19 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

UNC3886G1048 ↗

Has established remote SSH access to targeted ESXi hosts.1 2

created 2025-05-292 references

Storm-1811G1046 ↗

Has used OpenSSH to establish an SSH tunnel to victims for persistent access.1

created 2025-03-141 reference

Salt TyphoonG1045 ↗

Has modified the loopback address on compromised switches and used them as the source of SSH connections to additional devices within the target environment, allowing them to bypass access control lists (ACLs).1

created 2025-02-241 reference

APT5G1023 ↗

Has used SSH for lateral movement in compromised environments including for enabling access to ESXi host servers.1

created 2024-02-051 referenceaka Mulberry Typhoon

FIN13G1016 ↗

Has remotely accessed compromised environments via secure shell (SSH) for lateral movement.1

created 2023-07-271 referenceaka Elephant Beetle

Scattered SpiderG1015 ↗

Has used SSH to move laterally in victim environments and to access the vSphere vCenter Server GUI.1 2

created 2023-07-052 referencesaka Roasted 0ktapus

All 19 groups for this technique · 6 newest in this preview

Offense vs defense T1021.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 2Sigma rules (cumulative) · 5Splunk ESCU (cumulative) · 9

first rule: 2022 Q2 · 2 of 3 campaigns plotted (C0032 (dated 2014) falls before the 2019 window)

SSH detection strategy DET0596

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Behavioral Detection of Remote SSH Logins Followed by Post-Login Execution

Enterprise

3 platforms

AN1638 · Linux

SSH login from a remote system (via sshd), followed by user context execution of suspicious binaries or privilege escalation behavior.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:EXECVE	EXECVE
Logon Session CreationDC0067	linux:syslog	None
Network Traffic FlowDC0078	NSM:Flow	TCP port 22 traffic

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Defines correlation window from login to first post-SSH process (e.g., 60s)
SuspiciousProcessList	List of binaries considered unusual in SSH context (e.g., nc, base64, bash -i)
UsernameFilter	Accounts of interest for SSH logins (e.g., root, admin)

AN1639 · macOS

SSH login detected via Unified Logs, followed by unusual process execution, especially outside normal user behavior patterns.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:osquery	process_events
Network Traffic ContentDC0085	macos:unifiedlog	process = 'ssh' OR eventMessage CONTAINS 'ssh'
Logon Session MetadataDC0088	macos:unifiedlog	process = 'sshd'

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Time range to correlate post-SSH activities (e.g., 45s)
UserContext	Define authorized users to reduce false positives
CommandLineKeywords	Suspicious terms like reverse shells, base64, curl

AN1640 · ESXi

SSH login via hostd or /var/log/auth.log, followed by CLI access to host shell or file manipulation in restricted areas.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	esxi:shell	None
Network Traffic FlowDC0078	esxi:vmkernel	port 22 access
Logon Session MetadataDC0088	esxi:auth	None

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedUsers	Legitimate SSH users to this host
TimeWindow	Correlate SSH login and unauthorized commands or shell access
CommandList	Flag commands like esxcli, rm, chmod post-login

Tests2ExecutorsPowerShell 1 · cmd 1Need elevation1 of 2Have prerequisites2Have cleanup2Platformswindows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

ESXi - Enable SSH via PowerCLI

windows

PowerShell

Required

Yes

An adversary enables the SSH service on a ESXi host to maintain persistent access to the host and to carryout subsequent operations.

Input arguments

Name	Type	Default	Description
vm_host	string	atomic.local	Specify the host name of the ESXi Server
vm_pass	string	pass	Specify the privilege user password on ESXi Server
vm_user	string	root	Specify the privilege user account on ESXi Server

Attack command

Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false 
Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass}
Get-VMHostService -VMHost #{vm_host} | Where-Object {$_.Key -eq "TSM-SSH" } | Start-VMHostService -Confirm:$false

Cleanup command

Set-PowerCLIConfiguration -InvalidCertificateAction Ignore -ParticipateInCEIP:$false -Confirm:$false 
Connect-VIServer -Server #{vm_host} -User #{vm_user} -Password #{vm_pass}
Get-VMHostService -VMHost #{vm_host} | Where-Object {$_.Key -eq "TSM-SSH" } | Stop-VMHostService -Confirm:$false

Prerequisite

Check if VMWARE PowerCLI PowerShell Module is installed.

Check

$RequiredModule = Get-Module -Name VMware.PowerCLI -ListAvailable
if (-not $RequiredModule) {exit 1}

Satisfy

Install-Module -Name VMware.PowerCLI

GUID4073348f-bf73-4665-a8fa-73fbcda14081

ESXi - Enable SSH via VIM-CMD

windows

cmd

—

Yes

An adversary enables SSH on an ESXi host to maintain persistence and creeate another command execution interface. Reference

Input arguments

Name	Type	Default	Description
vm_host	string	atomic.local	Specify the host name or IP of the ESXi server.
vm_pass	string	password	Specify the privileged user's password.
vm_user	string	root	Specify the privilege user account on the ESXi server.
plink_file	path	PathToAtomicsFolder\..\ExternalPayloads\plink.exe	Path to Plink

Attack command

echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "vim-cmd hostsvc/enable_ssh"

Cleanup command

echo "" | "#{plink_file}" -batch "#{vm_host}" -ssh -l #{vm_user} -pw "#{vm_pass}" "vim-cmd hostsvc/disable_ssh"

Prerequisite

Check if we have plink

Check

if (Test-Path "#{plink_file}") {exit 0} else {exit 1}

Satisfy

New-Item -Type Directory "PathToAtomicsFolder\..\ExternalPayloads\" -ErrorAction Ignore -Force | Out-Null
Invoke-WebRequest "https://the.earth.li/~sgtatham/putty/latest/w64/plink.exe" -OutFile "#{plink_file}"

GUID4f553406-e884-4a8c-9412-aedbcae0d7da

Tests from Atomic Red Team (MIT licence) · technique definition

SSH detections T1021.004

14 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 18%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs