Community Enterprise Plans
Intel Exchange
Intel Exchange Detections
Resources
About
Leaderboard

Join Community Sign In

regreSSHion - Remote Unauthenticated Code Execution Vulnerability in OpenSSH server

Steven Lim@KQLWizard

•updated Jul 1, 2025•2•0•54

KQL Query

Microsoft Sentinel (KQL)

Tags

T1078.003 - Local Accounts T1136.001 - Local Account T1082 - System Information Discovery T1018 - Remote System Discovery TA0005 - Defense Evasion TA0003 - Persistence TA0004 - Privilege Escalation TA0001 - Initial Access TA0007 - Discovery S0377 - Ebury S0487 - Kessel S0486 - Bonadan T1593.003 - Code Repositories T1116 - Code Signing TA0002 - Execution T1506 - Web Session Cookie T1550.004 - Web Session Cookie T1075 - Pass the Hash T1184 - SSH Hijacking T1021.004 - SSH TA0043 - Reconnaissance TA0008 - Lateral Movement Vulnerability Scan Detected System Monitoring Status Remote Access Session Azure Linux Azure Monitor Logs Openssh Serverkql

Community Inspired.
AI Enhanced.
Better Detections.

Follow Us

Company

About
Leaderboard

Product

Community
Enterprise
Plans

© 2026 Copyright. All Rights Reserved.

Privacy Policy Terms of Service

Sign up to view this detection

or

Already have an account?