Shell Invocation Via Ssh - Linux

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2025•2•0•23

Detects the use of the "ssh" utility to execute a shell, which can indicate privilege escalation, unauthorized command execution, or breakout from restricted environments. The rule specifically looks for `ssh` commands that include `ProxyCommand=;`, `permitlocalcommand=yes`, or `localhost` in conjunction with common shell invocations like `/bin/bash`, `/bin/sh`, etc.