MITRE ATT&CKsub-technique

T1021.004 SSH

Published 2020-02-11 Modified 2026-09-18 Official page ↗
Domain
enterprise
Tactics
Lateral Movement
Platforms
ESXi, Linux, macOS, Windows
Version
1.4
Created
2020-02-11

Description

Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH). The adversary may then perform actions as the logged-on user. SSH is a protocol that allows authorized users to open remote shells on other computers. Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it. On ESXi, SSH can be enabled either directly on the host (e.g., via `vim-cmd hostsvc/enable_ssh`) or via vCenter. Modern versions of Windows include a built-in SSH server and client. The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password. In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user (i.e., SSH Authorized Keys).

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1021 Remote Services technique

Tactic · MITRE ATT&CK (1)

  • TA0008 Lateral Movement tactic

Referenced by MITRE ATT&CK · mitigates (3)

  • M1042 Disable or Remove Feature or Program mitigation
  • M1032 Multi-factor Authentication mitigation
  • M1018 User Account Management mitigation

Referenced by MITRE ATT&CK · uses (28)

  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • S1242 Qilin software (malware)
  • G1048 UNC3886 group
  • G1046 Storm-1811 group
  • G1045 Salt Typhoon group
  • C0049 Leviathan Australian Intrusions campaign
  • S1187 reGeorg software (malware)
  • C0032 C0032 campaign
  • C0029 Cutting Edge campaign
  • G1023 APT5 group
  • G1016 FIN13 group
  • G1015 Scattered Spider group
  • G0143 Aquatic Panda group
  • G0139 TeamTNT group
  • S0599 Kinsing software (malware)
  • G0119 Indrik Spider group
  • G0117 Fox Kitten group
  • G0106 Rocke group
  • G0098 BlackTech group
  • S0363 Empire software (tool)
  • G0087 APT39 group
  • G0065 Leviathan group
  • G0049 OilRig group
  • S0154 Cobalt Strike software (malware)
  • G0032 Lazarus Group group
  • G0036 GCMAN group
  • G0045 menuPass group
  • G0046 FIN7 group

Referenced by Compliance · mitigates (22)

  • CIS-13.5 Manage Access Control for Remote Access CIS Safeguard v8.1
  • CIS-4.4 Implement and Manage a Firewall on Servers CIS Safeguard v8.1
  • CIS-4.5 Implement and Manage a Firewall on End-User Devices CIS Safeguard v8.1
  • CIS-4.6 Securely Manage Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software CIS Safeguard v8.1
  • CIS-6.4 Require MFA for Remote Network Access CIS Safeguard v8.1
  • CIS-6.8 Define and Maintain Role-Based Access Control CIS Safeguard v8.1
  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-AC-7 Unsuccessful Logon Attempts NIST 800-53 control
  • NIST-CM-2 Baseline Configuration NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-CM-8 System Component Inventory NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-RA-5 Vulnerability Monitoring and Scanning NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control

References