KQL Search

This query is designed to detect potentially malicious SSH reverse tunneling activities, which can be used by attackers to maintain control over a compromised system or to move laterally within a network. Here's a simple breakdown of the query and its purpose:

1. Objective: The query aims to identify SSH processes that might be used for reverse tunneling or remote port forwarding to external hosts. This is a technique often used by attackers to establish persistent command-and-control channels or to pivot from an internal network to external infrastructure.

2. Detection Criteria:

   • It looks for the creation of SSH processes (ssh.exe) on devices.
   • Specifically, it searches for SSH commands that include flags for remote forwarding (-R) or local forwarding (-L), or the term "RemoteForward" in the command line. These flags are indicative of port forwarding activities.
   • The query captures details such as the timestamp of the event, the device name, the account initiating the process, the full command line used, and a report ID for further investigation.

3. Context:

   • The rule is based on a report detailing how attackers use such techniques in real-world scenarios, specifically referencing a case involving ransomware delivery.
   • It is tagged under categories like Command and Control and Lateral Movement, aligning with MITRE ATT&CK techniques for protocol tunneling and network sniffing.

4. Considerations:

   • The rule is noted to be "noisy," meaning it may generate many alerts, including false positives. Therefore, it might require tuning to filter out legitimate SSH activities that match the criteria but are not malicious.

In summary, this query helps security teams identify suspicious SSH activities that could indicate an attacker's attempt to establish unauthorized network connections or control channels. However, due to its broad detection criteria, it may need refinement to reduce false alarms.