Merge pull request #176 from akat12/Ssh

Create Ssh

yml/OSBinaries/Ssh.yml

@@ -0,0 +1,27 @@
+---
+Name: ssh.exe
+Description: Ssh.exe is the OpenSSH compatible client can be used to connect to Windows 10 (build 1809 and later) and Windows Server 2019 devices.
+Author: 'Akshat Pradhan'
+Created: '2021-11-08'
+Commands:
+  - Command: ssh localhost calc.exe
+    Description: Execute calc.exe on host machine. The prompt for password can be eliminated by adding the host's public key in the user's authorized_keys file. Adversaries can do the same for execution on remote machines.
+    Usecase: Execute specified command, can be used for defense evasion.
+    Category: Execute
+    Privileges: User
+    MitreID: T1202
+    OperatingSystem: Windows 10 1809, Windows Server 2019
+  - Command: ssh localhost calc.exe
+    Description: Executes calc.exe.
+    Usecase: Performs execution of specified file, can be used to bypass Application Whitelisting.
+    Category: AWL Bypass
+    Privileges: User
+    MitreID: T1218
+    OperatingSystem: Windows 10 1809, Windows Server 2019
+Full_Path:
+  - Path: c:\windows\system32\OpenSSH\ssh.exe
+Detection:
+  - IOC: Event ID 4624 with process name C:\Windows\System32\OpenSSH\sshd.exe.
+  - IOC: command line arguments specifying execution.
+Acknowledgement:
+  - Person: Akshat Pradhan