Program Executed Using Proxy/Local Command Via SSH.EXE

SigmaHQ Detections@sigmaHQ

•updated Oct 16, 2025•3•1•18

This rule detects the usage of the 'ssh.exe' binary as a proxy to launch other programs. This technique can be abused by adversaries for defense evasion and to execute arbitrary commands. The detection specifically looks for 'ssh.exe' being spawned by 'sshd.exe' or for 'ssh.exe' command lines containing 'ProxyCommand=' or 'PermitLocalCommand=yes' and 'LocalCommand'.