'SSHole' OpenSSH Authentication Bypass Under Active Exploitation: Detection, Hardening, and Remediation Guide

---
title: SSH Daemon Spawning Interactive Shell or Command Execution
id: 3f8c1a92-6b4e-4d7a-9c21-8e5f2a6b3d01
status: experimental
description: Detects sshd spawning shell processes, which may indicate successful interactive login via the SSHole authentication bypass or post-exploitation command execution. Correlate with expected administrative activity and source IPs.
references:
  - https://www.securityweek.com/hackers-exploiting-sshole-authentication-bypass-in-openssh/
  - https://attack.mitre.org/techniques/T1021/004/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.lateral_movement
  - attack.t1021.004
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/sshd'
      - '/sshd-session'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate administrative SSH sessions — baseline expected admin source IPs and service accounts
  - Configuration management (Ansible, Salt) executing over SSH
level: high
---
title: SSHD Configuration or Authorized Keys Tampering
id: 7b2e4f18-9c3a-4e6d-b152-4d8a7f9c2e05
status: experimental
description: Detects modification of sshd_config or authorized_keys files, a common persistence and weakening technique observed in SSH compromise campaigns including crypto-miner intrusions exploiting authentication bypass flaws.
references:
  - https://www.securityweek.com/hackers-exploiting-sshole-authentication-bypass-in-openssh/
  - https://attack.mitre.org/techniques/T1098/004/
  - https://attack.mitre.org/techniques/T1556/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.persistence
  - attack.t1098.004
  - attack.defense_evasion
  - attack.t1562
logsource:
  category: process_creation
  product: linux
detection:
  selection_path:
    CommandLine|contains:
      - 'sshd_config'
      - 'authorized_keys'
  selection_write:
    CommandLine|contains:
      - 'echo '
      - 'sed '
      - 'tee '
      - 'cat >'
      - 'cat >>'
      - 'printf '
      - 'vim '
      - 'nano '
      - 'vi '
  selection_risky_settings:
    CommandLine|contains:
      - 'PermitEmptyPasswords'
      - 'PermitRootLogin'
      - 'PasswordAuthentication'
      - 'PermitUserEnvironment'
      - 'AuthorizedKeysFile'
  condition: selection_path and (selection_write or selection_risky_settings)
falsepositives:
  - Legitimate SSH hardening or key rotation by administrators — alert anyway and verify change tickets
level: high
---
title: Crypto Miner Deployment Indicators on Linux
id: c41d9e67-2f8b-4a5c-9e37-1b6d3a8f4c09
status: experimental
description: Detects execution patterns associated with cryptocurrency miner deployment commonly observed following SSH compromise, including known miner binaries, download-and-execute chains, and miner pool references.
references:
  - https://www.securityweek.com/hackers-exploiting-sshole-authentication-bypass-in-openssh/
  - https://attack.mitre.org/techniques/T1496/
author: Security Arsenal
date: 2026/02/10
tags:
  - attack.impact
  - attack.t1496
  - attack.command_and_control
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_binary:
    Image|endswith:
      - '/xmrig'
      - '/kdevtmpfsi'
      - '/kinsing'
      - '/minerd'
      - '/cpuminer'
  selection_clis:
    CommandLine|contains:
      - 'stratum+tcp://'
      - 'stratum+ssl://'
      - '--donate-level'
      - 'xmr.pool'
      - 'supportxmr'
      - 'nanopool'
      - 'minexmr'
      - ' --coin'
      - '--algo rx/'
  selection_download_exec:
    CommandLine|contains:
      - 'curl '
      - 'wget '
  selection_pipe_shell:
    CommandLine|contains:
      - '| bash'
      - '| sh'
      - '|bash'
      - '|sh'
  condition: selection_binary or selection_clis or (selection_download_exec and selection_pipe_shell)
falsepositives:
  - Rare; legitimate use of stratum mining protocols or download-pipe-to-shell patterns in production is an anti-pattern worth flagging regardless
level: critical

// Hunt 1: Suspicious SSH authentication activity — successful logins from rare/external sources
// Tune the lookback and baseline window to your environment
let Lookback = 24h;
let Baseline = 14d;
let KnownSources = Syslog
| where TimeGenerated between (ago(Baseline) .. ago(Lookback))
| where Facility =~ "auth" or ProcessName =~ "sshd"
| where SyslogMessage has "Accepted"
| extend SourceIP = extract(@"from (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
| where isnotempty(SourceIP)
| summarize by SourceIP;
Syslog
| where TimeGenerated > ago(Lookback)
| where Facility =~ "auth" or ProcessName =~ "sshd"
| where SyslogMessage has "Accepted"
| extend SourceIP = extract(@"from (\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})", 1, SyslogMessage)
| extend AuthUser = extract(@"Accepted \S+ for (\S+)", 1, SyslogMessage)
| where isnotempty(SourceIP)
| where SourceIP !in (KnownSources)
| summarize AcceptedLogins = count(), DistinctUsers = dcount(AuthUser), Users = make_set(AuthUser), Hosts = make_set(HostName) by SourceIP, bin(TimeGenerated, 1h)
| order by TimeGenerated desc;
// Hunt 2: Post-exploitation — sshd spawning download tools, shells, or miner behavior (MDE on Linux)
DeviceProcessEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName =~ "sshd" or InitiatingProcessCommandLine has "sshd"
| where FileName in~ ("curl", "wget", "bash", "sh", "python", "python3", "perl", "base64", "crontab")
   or ProcessCommandLine has_any ("stratum", "xmrig", "authorized_keys", "sshd_config", "| bash", "| sh")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, RemoteIP
| order by TimeGenerated desc;

-- SSHole Post-Exploitation Hunt: SSH key/config tampering + miner processes
-- Part 1: Recently modified authorized_keys and sshd_config files (last 7 days)
SELECT FullPath, Mtime, Size,
       parse_file(filename=FullPath) AS ContentPreview
FROM glob(globs=[
  '/root/.ssh/authorized_keys',
  '/home/*/.ssh/authorized_keys',
  '/etc/ssh/sshd_config',
  '/etc/ssh/sshd_config.d/*'
])
WHERE Mtime > now() - (7 * 24 * 3600)
ORDER BY Mtime DESC

-- Part 2: Processes with miner indicators or shells parented to sshd, with network connections
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'stratum|xmrig|minerd|kdevtmpfsi|kinsing|--donate-level'
   OR Name =~ 'xmrig|minerd|kinsing'
   OR (Name =~ 'bash|sh|curl|wget|python|perl'
       AND Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ 'sshd'))

-- Part 3: Established outbound connections from unexpected processes (miner C2 / pool traffic)
SELECT Pid, Name, CommandLine, RemoteIP, RemotePort, Status
FROM netstat()
WHERE Status =~ 'ESTABLISHED'
  AND RemotePort IN (3333, 4444, 5555, 7777, 14444, 45700)

#!/usr/bin/env bash
# SSHole Response: OpenSSH audit + hardening script
# Run as root. Review output before applying hardening on production systems.

set -u
LOG=/var/log/sshole_audit_$(date +%Y%m%d_%H%M%S).log
exec > >(tee -a "$LOG") 2>&1

echo "=== [1] OpenSSH Version ==="
ssh -V 2>&1
sshd -V 2>&1 || true
# Compare against your distro security tracker; if a fixed version is available:
# Debian/Ubuntu: apt-get update && apt-get install --only-upgrade openssh-server
# RHEL/Rocky/Alma: dnf update openssh-server

echo "=== [2] Package integrity check (detect tampered binaries) ==="
if command -v dpkg >/dev/null 2>&1; then
  dpkg -V openssh-server || echo "dpkg verify returned differences - review above"
elif command -v rpm >/dev/null 2>&1; then
  rpm -V openssh-server || echo "rpm verify returned differences - review above"
fi

echo "=== [3] Audit sshd_config for dangerous settings ==="
SSHD_CFG=/etc/ssh/sshd_config
grep -Ein '^\s*(PermitEmptyPasswords|PermitRootLogin|PasswordAuthentication|PermitUserEnvironment|AllowTcpForwarding|X11Forwarding)' "$SSHD_CFG" /etc/ssh/sshd_config.d/*.conf 2>/dev/null || echo "No explicit risky directives found (check defaults)"

echo "=== [4] Recently modified authorized_keys / sshd_config (last 14 days) ==="
find /root/.ssh /home/*/.ssh /etc/ssh -name 'authorized_keys*' -o -name 'sshd_config*' 2>/dev/null | xargs -r ls -la
find /root/.ssh /home/*/.ssh -name 'authorized_keys' -mtime -14 -exec sh -c 'echo "MODIFIED: $1"; cat "$1"' _ {} \; 2>/dev/null

echo "=== [5] Unexpected local accounts with valid shells ==="
awk -F: '($7 ~ /(bash|sh|zsh)$/) && ($3 >= 1000 || $3 == 0) {print $1" uid="$3" shell="$7}' /etc/passwd

echo "=== [6] Miner indicators: processes and persistence ==="
ps aux | grep -Ei 'xmrig|minerd|kinsing|kdevtmpfsi|stratum' | grep -v grep || echo "No obvious miner processes"
crontab -l 2>/dev/null; ls -la /etc/cron.d/ /var/spool/cron/ 2>/dev/null
systemctl list-units --type=service --state=running | grep -Eiv 'systemd|dbus|cron|sshd|network|audit|rsyslog|journal' || true

echo "=== [7] Hardening recommendations (apply manually after review) ==="
cat <<'EOF'
Add/verify in /etc/ssh/sshd_config (or /etc/ssh/sshd_config.d/99-hardening.conf):
  PermitRootLogin no
  PasswordAuthentication no        # enforce key-only auth
  PermitEmptyPasswords no
  KbdInteractiveAuthentication no
  MaxAuthTries 3
  LoginGraceTime 30
  AllowUsers <explicit_admin_list>  # or AllowGroups ssh-admins
  AllowTcpForwarding no            # unless required
  X11Forwarding no
Then: sshd -t && systemctl reload sshd
Additionally:
  - Restrict TCP/22 to known admin CIDRs via firewall/security group
  - Deploy fail2ban or equivalent as defense-in-depth (does NOT stop a bypass)
  - Enable auditd rules: -w /etc/ssh/sshd_config -p wa -k sshd_config_change
EOF

echo "=== Audit complete. Log saved to $LOG ==="