.. / ssh.exe
Star

Ssh.exe is the OpenSSH compatible client can be used to connect to Windows 10 (build 1809 and later) and Windows Server 2019 devices.


Paths:

Acknowledgements:

Detection:

Execute

Execute calc.exe on host machine. The prompt for password can be eliminated by adding the host's public key in the user's authorized_keys file. Adversaries can do the same for execution on remote machines.
ssh localhost calc.exe
Usecase: Execute specified command, can be used for defense evasion.
Privileges required: User
OS: Windows 10 1809, Windows Server 2019
MITRE ATT&CK®: T1202



AWL bypass

Executes calc.exe.
ssh localhost calc.exe
Usecase: Performs execution of specified file, can be used to bypass Application Whitelisting.
Privileges required: User
OS: Windows 10 1809, Windows Server 2019
MITRE ATT&CK®: T1218