IOC: Event ID 4624 with process name C:\Windows\System32\OpenSSH\sshd.exe.
IOC: command line arguments specifying execution.
Execute
Execute calc.exe on host machine. The prompt for password can be eliminated by adding the host's public key in the user's authorized_keys file. Adversaries can do the same for execution on remote machines.
ssh localhost calc.exe
Usecase: Execute specified command, can be used for defense evasion.
Privileges required: User
OS: Windows 10 1809, Windows Server 2019
MITRE ATT&CK®: T1202
Executes calc.exe from ssh.exe
ssh -o ProxyCommand=calc.exe .
Usecase: Performs execution of specified file, can be used as a defensive evasion.
Privileges required: User
OS: Windows 10
MITRE ATT&CK®: T1202