# Detecting SSH Lateral Movement on macOS

Published: 2020-12-10 · Severity: low · Sectors: technology
Canonical: https://vorant.io/reports/daac8fed-23d8-59d4-b80b-7a7e6fc360ef/detecting-ssh-lateral-movement-on-macos

> A threat hunting guide details macOS SSH process trees and Splunk detection logic for brute-force attempts, successful logins, and root abuse.

This Objective-See blog post is an educational threat-hunting piece rather than an incident report, focused on how SSH-based lateral movement and credential abuse can be detected on macOS endpoints. The author explains the chain of processes involved in an SSH login (smd, sshd, sshd-keygen-wrapper, ssh-agent, and the resulting shell) and how tools like TrueTree reveal parent-child relationships that standard ps output obscures. This process tree understanding is presented as key to distinguishing legitimate developer/administrator SSH usage from malicious lateral movement using stolen or brute-forced credentials.

The piece provides concrete detection methodology: using Splunk queries to bucket sshd-keygen-wrapper executions in time windows to detect brute-force/dictionary attacks (e.g., >20 attempts in 5 minutes from a host), identifying successful logins via shell processes spawned with sshd as parent, distinguishing interactive sessions from one-off remote commands via command-line argument analysis, flagging root-level logins via uid 0 on spawned shells, and using tty values to reconstruct all commands executed during a given SSH session. The author notes that macOS build servers, test servers, and developer systems are more likely than typical endpoints to have SSH enabled, making them attractive targets for attackers who use SSH as a living-off-the-land technique for lateral movement once initial access is achieved.

No specific threat actor, malware, or active campaign is described; this is a defensive detection-engineering resource aimed at blue teams and EDR/SIEM practitioners, with generic references to credential-stuffing botnets targeting SSH servers on Linux/macOS.

Source reporting: https://objective-see.org/blog/blog_0x5D.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/daac8fed-23d8-59d4-b80b-7a7e6fc360ef/detecting-ssh-lateral-movement-on-macos.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup