Detecting SSH Lateral Movement on macOS

A threat hunting guide details macOS SSH process trees and Splunk detection logic for brute-force attempts, successful logins, and root abuse.

This Objective-See blog post is an educational threat-hunting piece rather than an incident report, focused on how SSH-based lateral movement and credential abuse can be detected on macOS endpoints. The author explains the chain of processes involved in an SSH login (smd, sshd, sshd-keygen-wrapper, ssh-agent, and the resulting shell) and how tools like TrueTree reveal parent-child relationships that standard ps output obscures. This process tree understanding is presented as key to distinguishing legitimate developer/administrator SSH usage from malicious lateral movement using stolen or brute-forced credentials.

The piece provides concrete detection methodology: using Splunk queries to bucket sshd-keygen-wrapper executions in time windows to detect brute-force/dictionary attacks (e.g., >20 attempts in 5 minutes from a host), identifying successful logins via shell processes spawned with sshd as parent, distinguishing interactive sessions from one-off remote commands via command-line argument analysis, flagging root-level logins via uid 0 on spawned shells, and using tty values to reconstruct all commands executed during a given SSH session. The author notes that macOS build servers, test servers, and developer systems are more likely than typical endpoints to have SSH enabled, making them attractive targets for attackers who use SSH as a living-off-the-land technique for lateral movement once initial access is achieved.

No specific threat actor, malware, or active campaign is described; this is a defensive detection-engineering resource aimed at blue teams and EDR/SIEM practitioners, with generic references to credential-stuffing botnets targeting SSH servers on Linux/macOS.

title: Shell Process Spawned from sshd Parent with Root Privilege
description: Detects bash, zsh, or sh processes spawned directly by sshd running with
  UID 0 (root), typical of successful root-level SSH lateral movement. Distinguishes
  from one-off commands by checking for shell interpreter invocation without explicit
  -c flag.
tags:
- attack.lateral-movement
- attack.t1021.004
- attack.privilege-escalation
- attack.t1078
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|endswith: /sshd
    Image|endswith:
    - /bash
    - /zsh
    - /sh
    User: root
  filter_command_execution:
    CommandLine|contains: ' -c '
  condition: selection and not filter_command_execution
falsepositives:
- Legitimate administrators or developers connecting via SSH to perform interactive
  work
- Automated scripts that spawn root shells via SSH for legitimate maintenance
level: high
id: ff346bd0-72d4-5b66-9717-3902c7402fb7
status: experimental
author: Vorant

title: 'Successful SSH Login Session: sshd Spawning User Shell Without -c Flag'
description: Detects bash, zsh, or sh processes spawned by sshd without the -c flag,
  which indicates an interactive login session rather than a remote command execution.
  When -c is present, the shell is executing a single command passed by sshd; its
  absence suggests the attacker or user has obtained an interactive shell, characteristic
  of lateral movement.
tags:
- attack.lateral-movement
- attack.t1021.004
- attack.t1059
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|endswith: /sshd
    Image|endswith:
    - /bash
    - /zsh
    - /sh
  filter_noninteractive:
    CommandLine|contains: ' -c '
  condition: selection and not filter_noninteractive
falsepositives:
- Administrators or developers using SSH interactively for regular system administration
- CI/CD pipelines that establish interactive SSH shells for deployment or debugging
level: low
id: 97b0e135-2837-5894-9308-afcdbff4dfab
status: experimental
author: Vorant

Source reporting: https://objective-see.org/blog/blog_0x5D.html