Identifier / Programs / Windows
ssh.exe
Secure Shell is a protocol used to securely log onto remote systems. It can be used for logging or executing commands on a remote server. tldr-pages
LOLBAS Execute 3 Sigma rules name it 5 ATT&CK techniques 3 documented commands 5 known copies with hashes
How ssh.exe is abused
Execute T1202 Indirect Command Execution
localhost
Execute T1202 Indirect Command Execution
-oEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for ssh.exe.
3 documented commands
Execute T1202 Indirect Command Execution User privileges
Executes specified command on host machine. The prompt for password can be eliminated by adding the host's public key in the user's authorized_keys file. Adversaries can do the same for execution on remote machines.
ssh localhost "{CMD}"Trips no Sigma process-creation rule.
Execute T1202 Indirect Command Execution User privileges
Executes specified command from ssh.exe
ssh -o ProxyCommand="{CMD}" .Trips 1 Sigma rule: mediumProgram Executed Using Proxy/Local Command Via SSH.EXE by frack113, Nasreddine Bencherchali
Execute T1202 Indirect Command Execution User privileges
Executes a DLL from an SMB share by abusing the PKCS11Provider option. The payload executes upon DLL load (DllMain) and requires exporting C_GetFunctionList to prevent premature termination by ssh.exe. Note that all backslashes should be escaped (i.e. every \ should be turned into \\).
ssh -o PKCS11Provider="\\\\127.0.0.1\\Temp\\example.dll" win@github.comTrips no Sigma process-creation rule.
1 of the 3 commands the identifier reads trips a Sigma process-creation rule; 2 trip none. These commands and their descriptions are from LOLBAS’s entry for ssh.exe, by Akshat Pradhan, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for ssh.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real ssh.exe?
C:\Windows\system32\OpenSSH\C:\Users\user\AppData\Local\GitHubDesktop\app-2.5.3\resources\app\git\usr\bin\C:\Users\user\AppData\Local\GitHubDesktop\app-2.5.4\resources\app\git\usr\bin\5 known copies
8.1.0.1 · C:\WINDOWS\system32\OpenSSH\ssh.exe · signed by Microsoft Windows
0d6b181edc282e0f14b3db6c59235290b1a5e7772f3fcf859fe7e92d57fec9fc8.1.0.1 · C:\Windows\system32\OpenSSH\ssh.exe · signed by Microsoft Windows
722bee41ccf54b88660c0e67adeb2c9612c18d739e5a8eb8c35c3d7066a958717.7.2.1 · C:\Windows\system32\OpenSSH\ssh.exe · signed by Microsoft Windows
0c0e91427a4b0e4cd0b59bdb73054252fb74c0977d13a73ab7423e15528b0485Version not recorded · C:\Users\user\AppData\Local\GitHubDesktop\app-2.5.3\resources\app\git\usr\bin\ssh.exe · signed by GitHub
4c259bbbb1ab6c554c4ac65218740590b71603306d92552bda41c951e5a6a962Version not recorded · C:\Users\user\AppData\Local\GitHubDesktop\app-2.5.4\resources\app\git\usr\bin\ssh.exe · signed by GitHub
937f3317fad790c1f3980cb12b31ca6d000698ab99e31839f1cfec575e4193b7From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
Connect to a remote server
ssh username@remote_hostIdentifyConnect to a remote server with a specific identity (private key)
ssh username@remote_host -i path/to/key_fileIdentifyConnect to a remote server with IP 10.0.0.1 and using a specific port (Note: 10.0.0.1 can be shortened to 10.1)
ssh username@10.0.0.1 -p 2222IdentifyNone of the 3 examples the identifier reads matches LOLBAS abuse or trips a Sigma process-creation rule.