Skip to content

OpenSSH

Overview

OpenSSH is the premier connectivity tool for remote login with the SSH protocol. It encrypts all traffic to eliminate eavesdropping, connection hijacking, and other attacks. In addition, OpenSSH provides a large suite of secure tunneling capabilities, several authentication methods, and sophisticated configuration options.

The following Sekoia.io built-in rules match the intake OpenSSH. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.

SEKOIA.IO x OpenSSH on ATT&CK Navigator

Active Directory Data Export Using Csvde

Detects the use of Csvde, a command-line tool from Windows Server that can be used to export Active Directory data to CSV files. This export doesn't include password hashes, but can be used as a discovery tool to enumerate users, machines and group memberships.

  • Effort: elementary
AdFind Usage

Detects the usage of the AdFind tool. AdFind.exe is a free tool that extracts information from Active Directory. Wizard Spider (Bazar, TrickBot, Ryuk), FIN6 and MAZE operators have used AdFind.exe to collect information about Active Directory organizational units and trust objects

  • Effort: elementary
Adexplorer Usage

Detects the usage of Adexplorer, a legitimate tool from the Sysinternals suite that could be abused by attackers as it can saves snapshots of the Active Directory Database.

  • Effort: advanced
Aspnet Compiler

Detects the starts of aspnet compiler.

  • Effort: advanced
Certificate Authority Modification

Installation of new certificate(s) in the Certificate Authority can be used to trick user when spoofing website or to add trusted destinations.

  • Effort: master
Exfiltration And Tunneling Tools Execution

Execution of well known tools for data exfiltration and tunneling

  • Effort: advanced
Kernel Module Alteration

Kernel module installation can be used to configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

  • Effort: advanced
Network Scanning and Discovery

Tools and command lines used for network discovery from current system

  • Effort: advanced
Network Sniffing

List of common tools used for network packages sniffing

  • Effort: advanced
Network Sniffing Windows

Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

  • Effort: intermediate
PasswordDump SecurityXploded Tool

Detects the execution of the PasswordDump SecurityXploded Tool

  • Effort: elementary
PsExec Process

Detects PsExec execution, command line which contains pstools or installation of the PsExec service. PsExec is a SysInternals which can be used to execute a program on another computer. The tool is as much used by attackers as by administrators.

  • Effort: advanced
RDP Session Discovery

Detects use of RDP session discovery via qwinsta or quser. Used by some threat actors to know if someone is working via RDP on a server.

  • Effort: advanced
Remote Monitoring and Management Software - AnyDesk

Detect artifacts related to the installation or execution of the Remote Monitoring and Management tool AnyDesk.

  • Effort: master
Remote Monitoring and Management Software - Atera

Detect artifacts related to the installation or execution of the Remote Monitoring and Management tool Atera.

  • Effort: master
SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

  • Effort: elementary
Suspicious Double Extension

Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spearphishing campaigns

  • Effort: advanced
System Info Discovery

System info discovery, attempt to detects basic command use to fingerprint a host.

  • Effort: master

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Authentication logs Several SSH authentication methods are supported

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind ``
Category authentication, network, session
Type end, protocol, start

Event Samples

Find below few samples of events and how they are normalized by Sekoia.io.

{
    "message": " Accepted google_authenticator for root",
    "event": {
        "category": [
            "authentication"
        ],
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "action": {
        "name": "session",
        "outcome": "success",
        "outcome_reason": "Accepted google_authenticator for root",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "openssh": {
        "auth": {
            "method": "google_authenticator"
        }
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "user": [
            "root"
        ]
    },
    "source": {
        "user": {
            "name": "root"
        }
    },
    "user": {
        "name": "root"
    }
}

{
    "message": " Accepted gssapi-with-mic for ubuntu from 1.2.3.4 port 51826 ssh2",
    "event": {
        "category": [
            "authentication"
        ],
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "action": {
        "name": "session",
        "outcome": "success",
        "outcome_reason": "Accepted gssapi-with-mic for ubuntu from 1.2.3.4 port 51826 ssh2",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "openssh": {
        "auth": {
            "method": "gssapi-with-mic"
        }
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "ubuntu"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 51826,
        "user": {
            "name": "ubuntu"
        }
    },
    "user": {
        "name": "ubuntu"
    }
}

{
    "message": " Accepted password for ubuntu from 1.2.3.4 port 51826 ssh2",
    "event": {
        "category": [
            "authentication"
        ],
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "action": {
        "name": "session",
        "outcome": "success",
        "outcome_reason": "Accepted password for ubuntu from 1.2.3.4 port 51826 ssh2",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "openssh": {
        "auth": {
            "method": "password"
        }
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "ubuntu"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 51826,
        "user": {
            "name": "ubuntu"
        }
    },
    "user": {
        "name": "ubuntu"
    }
}

{
    "message": " Accepted publickey for ubuntu from 1.2.3.4 port 51826 ssh2: RSA SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=",
    "event": {
        "category": [
            "authentication"
        ],
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "action": {
        "name": "session",
        "outcome": "success",
        "outcome_reason": "Accepted publickey for ubuntu from 1.2.3.4 port 51826 ssh2: RSA SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=",
        "target": "user",
        "type": "open"
    },
    "file": {
        "hash": {
            "sha256": "AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs="
        }
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "openssh": {
        "auth": {
            "method": "publickey"
        }
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "hash": [
            "AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs="
        ],
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "ubuntu"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 51826,
        "user": {
            "name": "ubuntu"
        }
    },
    "user": {
        "name": "ubuntu"
    }
}

{
    "message": " Accepted publickey for jdoe@example.local from 1.2.3.4 port 59294 ssh2: ED25519 SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=",
    "event": {
        "category": [
            "authentication"
        ],
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "action": {
        "name": "session",
        "outcome": "success",
        "outcome_reason": "Accepted publickey for jdoe@example.local from 1.2.3.4 port 59294 ssh2: ED25519 SHA256:AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs=",
        "target": "user",
        "type": "open"
    },
    "file": {
        "hash": {
            "sha256": "AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs="
        }
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "openssh": {
        "auth": {
            "method": "publickey"
        }
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "hash": [
            "AbpHGcgLb+kRsJGnwFEktk7uzpZOCcBY74+YBdrKVGs="
        ],
        "hosts": [
            "example.local"
        ],
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "jdoe"
        ]
    },
    "source": {
        "address": "example.local",
        "domain": "example.local",
        "ip": "1.2.3.4",
        "port": 59294,
        "subdomain": "example",
        "user": {
            "name": "jdoe"
        }
    },
    "user": {
        "name": "jdoe"
    }
}

{
    "message": " error: maximum authentication attempts exceeded for invalid user support from ssh.example.org port 51219 ssh2 [preauth]",
    "event": {
        "category": [
            "session"
        ],
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "maximum authentication attempts exceeded",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "hosts": [
            "ssh.example.org"
        ],
        "user": [
            "support"
        ]
    },
    "source": {
        "address": "ssh.example.org",
        "domain": "ssh.example.org",
        "port": 51219,
        "registered_domain": "example.org",
        "subdomain": "ssh",
        "top_level_domain": "org",
        "user": {
            "name": "support"
        }
    },
    "user": {
        "name": "support"
    }
}

{
    "message": " error: maximum authentication attempts exceeded for root from 1.2.3.4 port 63758 ssh2 [preauth]",
    "event": {
        "category": [
            "session"
        ],
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "maximum authentication attempts exceeded",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "root"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 63758,
        "user": {
            "name": "root"
        }
    },
    "user": {
        "name": "root"
    }
}

{
    "message": " Disconnecting invalid user support 1.2.3.4 port 51219: Too many authentication failures [preauth]",
    "event": {
        "category": [
            "authentication"
        ],
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "Disconnecting",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "support"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 51219,
        "user": {
            "name": "support"
        }
    },
    "user": {
        "name": "support"
    }
}

{
    "message": " Bad protocol version identification '\\003' from 1.2.3.4 port 407",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "failure",
        "type": [
            "protocol"
        ]
    },
    "action": {
        "name": "negotiate",
        "outcome": "failure",
        "outcome_reason": "Bad protocol version",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 407
    }
}

{
    "message": " Connection closed by 1.2.3.4 port 51488 [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Connection closed by 1.2.3.4 port 51488 [preauth]",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 51488
    }
}

{
    "message": " Connection closed by authenticating user backup 1.2.3.4 port 49424 [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Connection closed by authenticating user backup 1.2.3.4 port 49424 [preauth]",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "backup"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 49424,
        "user": {
            "name": "backup"
        }
    },
    "user": {
        "name": "backup"
    }
}

{
    "message": " Connection closed by illegal user default 1.2.3.4 port 49424 [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Connection closed by illegal user default 1.2.3.4 port 49424 [preauth]",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "default"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 49424,
        "user": {
            "name": "default"
        }
    },
    "user": {
        "name": "default"
    }
}

{
    "message": " Connection closed by invalid user pi 1.2.3.4 port 42608 [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Connection closed by invalid user pi 1.2.3.4 port 42608 [preauth]",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "pi"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 42608,
        "user": {
            "name": "pi"
        }
    },
    "user": {
        "name": "pi"
    }
}

{
    "message": " Connection closed by invalid user 1.2.3.4 port 36797 [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Connection closed by invalid user 1.2.3.4 port 36797 [preauth]",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 36797
    }
}

{
    "message": " ssh_dispatch_run_fatal: Connection from 1.2.3.4 port 49065: Connection corrupted [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "failure",
        "type": [
            "protocol"
        ]
    },
    "action": {
        "name": "negotiate",
        "outcome": "failure",
        "outcome_reason": "ssh_dispatch_run_fatal:",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 49065
    }
}

{
    "message": " Connection reset by 1.2.3.4 port 45611 [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "reset",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 45611
    }
}

{
    "message": "Mar 11 11:26:54 foobar sshd[3296336]: Received disconnect from 1.1.1.1 port 33980:11: Bye Bye",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Bye Bye",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.1.1.1"
        ]
    },
    "source": {
        "address": "1.1.1.1",
        "ip": "1.1.1.1",
        "port": 33980
    }
}

{
    "message": " Disconnected from 1.2.3.4 port 39906 [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Disconnected from 1.2.3.4 port 39906 [preauth]",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 39906
    }
}

{
    "message": " Disconnected from authenticating user backup 1.2.3.4 port 49424 [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Disconnected from authenticating user backup 1.2.3.4 port 49424 [preauth]",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "backup"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 49424,
        "user": {
            "name": "backup"
        }
    },
    "user": {
        "name": "backup"
    }
}

{
    "message": " Disconnected from illegal user default 1.2.3.4 port 48792 [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Disconnected from illegal user default 1.2.3.4 port 48792 [preauth]",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "default"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 48792,
        "user": {
            "name": "default"
        }
    },
    "user": {
        "name": "default"
    }
}

{
    "message": " Disconnected from user ubuntu 1.2.3.4 port 44708",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Disconnected from user ubuntu 1.2.3.4 port 44708",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "ubuntu"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 44708,
        "user": {
            "name": "ubuntu"
        }
    },
    "user": {
        "name": "ubuntu"
    }
}

{
    "message": " Disconnected from user jdoe@lexample.local 1.2.3.4 port 33480",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Disconnected from user jdoe@lexample.local 1.2.3.4 port 33480",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "hosts": [
            "lexample.local"
        ],
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "jdoe"
        ]
    },
    "source": {
        "address": "lexample.local",
        "domain": "lexample.local",
        "ip": "1.2.3.4",
        "port": 33480,
        "subdomain": "lexample",
        "user": {
            "name": "jdoe"
        }
    },
    "user": {
        "name": "jdoe"
    }
}

{
    "message": "Failed none for invalid user guest from 1.2.3.4 port 15806 ssh2",
    "event": {
        "category": [
            "authentication"
        ],
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "Failed none",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "guest"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 15806,
        "user": {
            "name": "guest"
        }
    },
    "user": {
        "name": "guest"
    }
}

{
    "message": "fatal: userauth_finish: send failure packet: Broken pipe [preauth]",
    "event": {
        "category": [
            "session"
        ],
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "userauth_finish: send failure packet: Broken pipe [preauth]",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    }
}

{
    "message": " Failed password for backup from 1.2.3.4 port 60150 ssh2",
    "event": {
        "category": [
            "authentication"
        ],
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "Failed password",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "backup"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 60150,
        "user": {
            "name": "backup"
        }
    },
    "user": {
        "name": "backup"
    }
}

{
    "message": " Failed password for invalid user ***** from 1.2.3.4 port 51894 ssh2",
    "event": {
        "category": [
            "authentication"
        ],
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "Failed password",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 51894
    }
}

{
    "message": "fatal: Timeout before authentication for 1.2.3.4 port 52076",
    "event": {
        "category": [
            "session"
        ],
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "Timeout before authentication",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 52076
    }
}

{
    "message": " Invalid user jdoe from ssh.example.org port 48792",
    "event": {
        "category": [
            "authentication"
        ],
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "Invalid user",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "hosts": [
            "ssh.example.org"
        ],
        "user": [
            "jdoe"
        ]
    },
    "source": {
        "address": "ssh.example.org",
        "domain": "ssh.example.org",
        "port": 48792,
        "registered_domain": "example.org",
        "subdomain": "ssh",
        "top_level_domain": "org",
        "user": {
            "name": "jdoe"
        }
    },
    "user": {
        "name": "jdoe"
    }
}

{
    "message": " input_userauth_request: invalid user jdoe [preauth]",
    "event": {
        "category": [
            "authentication"
        ],
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "invalid user",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "user": [
            "jdoe"
        ]
    },
    "source": {
        "user": {
            "name": "jdoe"
        }
    },
    "user": {
        "name": "jdoe"
    }
}

{
    "message": " Invalid user ***** from 1.2.3.4 port 51894",
    "event": {
        "category": [
            "authentication"
        ],
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "Invalid user",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 51894
    }
}

{
    "message": " error: kex_exchange_identification: Connection closed by remote host",
    "event": {
        "category": [
            "session"
        ],
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "Connection closed by remote host",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    }
}

{
    "message": " Did not receive identification string from 1.2.3.4 port 50622",
    "event": {
        "category": [
            "session"
        ],
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "Did not receive identification string",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 50622
    }
}

{
    "message": " pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4",
    "event": {
        "category": [
            "authentication"
        ],
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "sshd:auth",
        "outcome": "failure",
        "outcome_reason": "pam_unix(sshd:auth): authentication failure;",
        "target": "user",
        "type": "authentication"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    }
}

{
    "message": " pam_unix(sshd:auth): check pass; user unknown",
    "event": {
        "category": [
            "authentication"
        ],
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "action": {
        "name": "sshd:auth",
        "outcome": "success",
        "outcome_reason": "pam_unix(sshd:auth): check pass; user unknown",
        "target": "user",
        "type": "check"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "user": [
            "unknown"
        ]
    },
    "source": {
        "user": {
            "name": "unknown"
        }
    },
    "user": {
        "name": "unknown"
    }
}

{
    "message": "PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4  user=root",
    "event": {
        "category": [
            "authentication"
        ],
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "sshd:auth",
        "outcome": "failure",
        "outcome_reason": "PAM 2 more authentication failures; logname= uid=0 euid=0 tty=ssh ruser= rhost=1.2.3.4  user=root",
        "target": "user",
        "type": "authentication"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "root"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "user": {
            "name": "root"
        }
    },
    "user": {
        "euid": "0",
        "id": "0",
        "name": "root"
    }
}

{
    "message": "PAM service(sshd) ignoring max retries; 6 > 3",
    "event": {
        "category": [
            "session"
        ],
        "outcome": "failure",
        "type": [
            "start"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "ignoring max retries; 6 > 3",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    }
}

{
    "message": " pam_unix(sshd:session): session closed for user ubuntu",
    "event": {
        "category": [
            "session"
        ],
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "sshd:session",
        "outcome": "success",
        "outcome_reason": "pam_unix(sshd:session): session closed for user ubuntu",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "user": [
            "ubuntu"
        ]
    },
    "source": {
        "user": {
            "name": "ubuntu"
        }
    },
    "user": {
        "name": "ubuntu"
    }
}

{
    "message": " pam_unix(sshd:session): session opened for user ubuntu by (uid=0)",
    "event": {
        "category": [
            "session"
        ],
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "action": {
        "name": "sshd:session",
        "outcome": "success",
        "outcome_reason": "pam_unix(sshd:session): session opened for user ubuntu by (uid=0)",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "user": [
            "ubuntu"
        ]
    },
    "source": {
        "user": {
            "name": "ubuntu"
        }
    },
    "user": {
        "name": "ubuntu"
    }
}

{
    "message": " pam_unix(sshd:session): session opened for user jdoe(uid=10357) by (uid=0)",
    "event": {
        "category": [
            "session"
        ],
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "action": {
        "name": "sshd:session",
        "outcome": "success",
        "outcome_reason": "pam_unix(sshd:session): session opened for user jdoe(uid=10357) by (uid=0)",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "user": [
            "jdoe"
        ]
    },
    "source": {
        "user": {
            "name": "jdoe"
        }
    },
    "user": {
        "euid": "10357",
        "id": "10357",
        "name": "jdoe"
    }
}

{
    "message": " pam_winbind(sshd:account): user 'jdoe@example.local' granted access",
    "event": {
        "category": [
            "session"
        ],
        "outcome": "success",
        "type": [
            "start"
        ]
    },
    "action": {
        "name": "sshd:session",
        "outcome": "success",
        "outcome_reason": "pam_winbind(sshd:account): user 'jdoe@example.local' granted access",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "hosts": [
            "example.local"
        ],
        "user": [
            "jdoe"
        ]
    },
    "source": {
        "address": "example.local",
        "domain": "example.local",
        "subdomain": "example",
        "user": {
            "name": "jdoe"
        }
    },
    "user": {
        "name": "jdoe"
    }
}

{
    "message": " Received disconnect from 1.2.3.4 port 39906:11: Bye Bye [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Bye Bye",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 39906
    }
}

{
    "message": " Received disconnect from 1.2.3.4 port 16899:11:  [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Received disconnect from 1.2.3.4 port 16899:11:  [preauth]",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 16899
    }
}

{
    "message": " Received disconnect from 1.2.3.4 port 36958:11: Normal Shutdown, Thank you for playing [preauth]",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "Normal Shutdown, Thank you for playing",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 36958
    }
}

{
    "message": " Received disconnect from 1.2.3.4 port 44708:11: disconnected by user",
    "event": {
        "category": [
            "network"
        ],
        "outcome": "success",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "success",
        "outcome_reason": "disconnected by user",
        "target": "user",
        "type": "close"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 44708
    }
}

{
    "message": " Unable to negotiate with 1.2.3.4 port 27824: no matching cipher found. Their offer: aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc,none [preauth]",
    "event": {
        "category": [
            "session"
        ],
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "negotiate",
        "outcome": "failure",
        "outcome_reason": "Unable to negotiate with 1.2.3.4 port 27824: no matching cipher found. Their offer: aes256-cbc,rijndael-cbc@lysator.liu.se,aes192-cbc,aes128-cbc,arcfour128,arcfour,3des-cbc,none [preauth]",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "port": 27824
    }
}

{
    "message": " User root from 1.2.3.4 not allowed because not listed in AllowUsers",
    "event": {
        "category": [
            "authentication"
        ],
        "outcome": "failure",
        "type": [
            "end"
        ]
    },
    "action": {
        "name": "connection",
        "outcome": "failure",
        "outcome_reason": "not allowed because not listed in AllowUsers",
        "target": "user",
        "type": "open"
    },
    "observer": {
        "product": "openssh",
        "type": "server",
        "vendor": "openbsd project"
    },
    "process": {
        "name": "sshd"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "root"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "user": {
            "name": "root"
        }
    },
    "user": {
        "name": "root"
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
action.target keyword
event.category keyword Event category. The second categorization field in the hierarchy.
event.outcome keyword The outcome of the event. The lowest level categorization field in the hierarchy.
event.type keyword Event type. The third categorization field in the hierarchy.
file.hash.sha256 keyword SHA256 hash.
observer.product keyword The product name of the observer.
observer.type keyword The type of the observer the data is coming from.
observer.vendor keyword Vendor name of the observer.
openssh.auth.method keyword
process.name keyword Process name.
source.domain keyword The domain name of the source.
source.ip ip IP address of the source.
source.port long Port of the source.
source.user.name keyword Short name or login of the user.
user.euid keyword
user.id keyword Unique identifier of the user.
user.name keyword Short name or login of the user.

Configure

As of now, the main solution to collect OpenSSH logs leverages the Rsyslog recipe. Please share your experiences with other recipes by editing this documentation.

Rsyslog

Please refer to the documentation of OpenSSH to forward events to your rsyslog server. The reader can consult the Rsyslog Transport documentation to forward these logs to Sekoia.io.

Further Readings