ATT&CK technique
View on MITRE ATT&CK →
T1563.001
SSH Hijacking
Lateral Movement
8 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Renaming of OpenSSH Binaries | production | 2026-10-08 |
| elastic | SSH Authorized Key File Activity Detected via Defend for Containers | production | 2026-09-18 |
| elastic | Potential THC Tool Downloaded | production | 2026-09-18 |
| elastic | SSH Key Generated via ssh-keygen | production | 2026-09-18 |
| elastic | SSH Authorized Keys File Activity | production | 2026-09-18 |
| elastic | Potential Execution via SSH Backdoor | production | 2026-09-18 |
| elastic | Unusual SSHD Child Process | production | 2026-09-18 |
| elastic | Network Connection Initiated by Suspicious SSHD Child Process | production | 2026-09-18 |