OpenSSH Server Listening On Socket

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•28

Detects scenarios where the OpenSSH server starts listening on an SSH socket, which could indicate an attacker enabling the service for remote access or persistence. This rule specifically looks for EventID 4 from the OpenSSH service with the process name 'sshd' and a payload starting with 'Server listening on '.