Wiki › Techniques, Tactics & Procedures (TTPs) › Lateral Movement › SSH-Based Lateral Movement

SSH-Based Lateral Movement

2 min read

Jump to:

Overview

SSH-Based Lateral Movement is a technique where adversaries leverage Secure Shell (SSH) protocols to move laterally within a network environment. It is commonly used after initial access to expand control over additional systems by exploiting legitimate administrative channels. This method enables attackers to maintain stealth and persistence while navigating through targeted networks.

Attack Objective

Gain access and control over additional systems within a network
Supports the Lateral Movement and Persistence stages of the attack lifecycle
Advances the attacker’s position by enabling access to new hosts and sensitive resources without raising immediate suspicion

How the Technique Works

Adversaries use SSH to authenticate and establish encrypted connections to remote systems, often utilizing stolen credentials or key-based authentication. Once connected, they execute commands or deploy tools to further their objectives. This approach leverages existing administrative protocols, making detection more challenging as it blends with legitimate network traffic.

Common Methods & Variations

Use of stolen or harvested SSH credentials for password or key-based authentication
Deployment of SSH agent forwarding or tunneling to access additional systems
Variations across on-premises servers, cloud environments, and hybrid infrastructures
Utilization of native SSH clients and utilities (living-off-the-land) versus custom or malicious SSH implementations

Indicators of Compromise (IOCs)

Unusual SSH login events, including logins at atypical times or from unexpected source IPs
Multiple failed or successful authentication attempts using compromised credentials
Creation or modification of authorized_keys files or SSH configuration files
Network traffic patterns consistent with SSH tunneling or port forwarding

Detection Strategies

Monitoring SSH authentication logs from endpoints and servers
Behavioral analysis to identify anomalies in login patterns and session durations
Correlation of network traffic with known SSH usage baselines to detect unusual connections

Mitigation & Prevention

Enforce strong authentication mechanisms, including multi-factor authentication for SSH access
Implement strict access controls and least privilege principles for SSH credentials and keys
Regularly audit and rotate SSH keys and credentials
Restrict SSH access through network segmentation and firewall rules

Response Considerations

Immediately revoke compromised SSH credentials and keys
Contain affected systems by isolating them from the network
Conduct thorough investigations to identify the scope of lateral movement and impacted assets
Harden SSH configurations and review access policies post-incident

Related Techniques

Credential Dumping to obtain SSH credentials
Remote Services exploitation for lateral movement
Use of Pass-the-Hash or Pass-the-Ticket techniques in conjunction with SSH access

Mapping & References

MITRE ATT&CK: T1021.004 – Remote Services: SSH
Public advisories on lateral movement techniques leveraging SSH
Incident reports detailing SSH-based lateral movement in enterprise environments

Tags: Attack Techniques credential theft Incident Response lateral movement network security persistence Remote Access SSH Threat Detection