Detecting SSH Lateral Movement on macOS
A threat hunting guide details macOS SSH process trees and Splunk detection logic for brute-force attempts, successful logins, and root abuse.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
This Objective-See blog post is an educational threat-hunting piece rather than an incident report, focused on how SSH-based lateral movement and credential abuse can be detected on macOS endpoints. The author explains the chain of processes involved in an SSH login (smd, sshd, sshd-keygen-wrapper, ssh-agent, and the resulting shell) and how tools like TrueTree reveal parent-child relationships that standard ps output obscures. This process tree understanding is presented as key to distinguishing legitimate developer/administrator SSH usage from malicious lateral movement using stolen or brute-forced credentials.
The piece provides concrete detection methodology: using Splunk queries to bucket sshd-keygen-wrapper executions in time windows to detect brute-force/dictionary attacks (e.g., >20 attempts in 5 minutes from a host), identifying successful logins via shell processes spawned with sshd as parent, distinguishing interactive sessions from one-off remote commands via command-line argument analysis, flagging root-level logins via uid 0 on spawned shells, and using tty values to reconstruct all commands executed during a given SSH session. The author notes that macOS build servers, test servers, and developer systems are more likely than typical endpoints to have SSH enabled, making them attractive targets for attackers who use SSH as a living-off-the-land technique for lateral movement once initial access is achieved.
No specific threat actor, malware, or active campaign is described; this is a defensive detection-engineering resource aimed at blue teams and EDR/SIEM practitioners, with generic references to credential-stuffing botnets targeting SSH servers on Linux/macOS.
Detection guidance
Shell Process Spawned from sshd Parent with Root Privilege
A behavioural hunt for the technique in general.
Interactive shell (bash/zsh/sh) spawned as direct child of sshd with UID 0, indicating successful root-level SSH login. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Process Spawned from sshd Parent with Root Privilege
description: Detects bash, zsh, or sh processes spawned directly by sshd running with
UID 0 (root), typical of successful root-level SSH lateral movement. Distinguishes
from one-off commands by checking for shell interpreter invocation without explicit
-c flag.
tags:
- attack.lateral-movement
- attack.t1021.004
- attack.privilege-escalation
- attack.t1078
logsource:
category: process_creation
product: macos
detection:
selection:
ParentImage|endswith: /sshd
Image|endswith:
- /bash
- /zsh
- /sh
User: root
filter_command_execution:
CommandLine|contains: ' -c '
condition: selection and not filter_command_execution
falsepositives:
- Legitimate administrators or developers connecting via SSH to perform interactive
work
- Automated scripts that spawn root shells via SSH for legitimate maintenance
level: high
id: ff346bd0-72d4-5b66-9717-3902c7402fb7
status: experimental
author: Vorant
Successful SSH Login Session: sshd Spawning User Shell Without -c Flag
A behavioural hunt for the technique in general.
Shell process directly spawned by sshd without -c command flag, indicating an interactive SSH session rather than a one-off remote command. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: 'Successful SSH Login Session: sshd Spawning User Shell Without -c Flag'
description: Detects bash, zsh, or sh processes spawned by sshd without the -c flag,
which indicates an interactive login session rather than a remote command execution.
When -c is present, the shell is executing a single command passed by sshd; its
absence suggests the attacker or user has obtained an interactive shell, characteristic
of lateral movement.
tags:
- attack.lateral-movement
- attack.t1021.004
- attack.t1059
logsource:
category: process_creation
product: macos
detection:
selection:
ParentImage|endswith: /sshd
Image|endswith:
- /bash
- /zsh
- /sh
filter_noninteractive:
CommandLine|contains: ' -c '
condition: selection and not filter_noninteractive
falsepositives:
- Administrators or developers using SSH interactively for regular system administration
- CI/CD pipelines that establish interactive SSH shells for deployment or debugging
level: low
id: 97b0e135-2837-5894-9308-afcdbff4dfab
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x5D.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs