SSH
Subtechnique · ATTACK:enterprise:T1021.004
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1021.004",
"title": "SSH",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1021/004",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--2db31dcd-54da-405d-acef-b9129b816ed6",
"external_id": "T1021.004",
"domain": "enterprise",
"created": "2020-02-11T18:27:15.774Z",
"modified": "2026-09-18T02:23:13.647Z",
"version": "1.4",
"aliases": [
],
"tactics": [
"lateral-movement"
],
"source_references": [
{
"source_name": "Sygnia Abyss Locker 2025",
"url": "https://www.sygnia.co/blog/abyss-locker-ransomware-attack-analysis/"
},
{
"source_name": "TrendMicro ESXI Ransomware",
"url": "https://www.trendmicro.com/en_us/research/22/a/analysis-and-Impact-of-lockbit-ransomwares-first-linux-and-vmware-esxi-variant.html"
},
{
"source_name": "Windows SSH",
"url": "https://learn.microsoft.com/en-us/windows/terminal/tutorials/ssh"
},
{
"source_name": "Sygnia ESXi Ransomware 2025",
"url": "https://www.sygnia.co/blog/esxi-ransomware-ssh-tunneling-defense-strategies/"
}
]
}Explicit source assertions (32)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0263d539-39f0-45ca-be2d-0f9198db9af0
Apple Unified Log Analysis Remote Login and Screen SharingATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15d87b47-837d-4f62-9d78-4ec092c111d2
CrowdStrike Carbon Spider August 2021ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1cf34ba1-c2e4-4277-86fc-b511ae416a0e
Kaspersky ThreatNeedle Feb 2021ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1dab22b7-52f9-4f2b-9e63-09b4db316cfd
AI-Mexico-Govt-BreachATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25e695b0-1110-43ab-be79-5e89e3951759
FireEye APT40 March 2019ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--303221b5-f6eb-4fa2-b9d6-dd6d856dd79e
Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:C0032 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37de6975-01c6-497f-bf45-902c302fae66
FireEye TRITON 2019ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--54d0d5d9-c601-4855-b2fb-7017ebf5adce
Mandiant VMware vSphere JUL 2025 · Mandiant UNC3944 May 2025ATTACK:enterprise:G0098 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55b0cb4d-1109-449c-82f6-ed42317df209
Symantec Palmerworm Sep 2020ATTACK:enterprise:S0363 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5daee125-eb83-4529-889e-18de7115f688
Github PowerShell EmpireATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--73cead10-011c-4131-a3dd-2858892ba1cb
Crowdstrike HuntReport 2022ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--75c238d1-f2dc-413a-89c3-66797a65da90
Cobalt Strike TTPs Dec 2017 · Cobalt Strike Manual 4.3 November 2020ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77c5bb7d-9584-4d57-850b-6349984181a8
ATTACK:enterprise:S1187 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77e5b3f9-a161-487c-b31a-e3229365baf5
Fortinet reGeorg MAR 2019ATTACK:enterprise:G0036 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7db7f665-6e29-4789-8a3d-d6cb8d0af31e
Securelist GCMANATTACK:enterprise:S0599 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90893c7e-5080-40ff-92b2-d9c86e74b72c
Aqua Kinsing April 2020ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--91b41079-6c44-439e-a76c-2a128a792e17
CISA AA20-259A Iran-Based Actor September 2020ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9420a4b5-d246-4b9e-81d0-3f0551a73a15
Cisco Talos Intelligence Group · Intezer TeamTNT September 2020ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--97b7c8f4-d3b2-4992-8801-c62c68a17eca
Microsoft Storm-1811 2024ATTACK:enterprise:S1242 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a87ca5db-1a5c-433a-a945-4fe74a883c4d
Cisco Talos Qilin Ransomware OCT 2025ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b16c27b4-f94b-43e4-832d-986c03b96ffd
ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7367fd5-bdd2-497e-a5f5-415fb833e56b
CISA_AA25-239ASaltTyphoon_Sept2025 · Cisco Salt Typhoon FEB 2025ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd83109f-198a-43b0-a4c9-c13dd671c2da
Unit42 OilRig Playbook 2023ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bec31996-2778-4e16-af9a-6a73f148a074
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e4b22c3e-24ae-4606-bd51-1f934f85034e
CISA Leviathan 2024ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e4e63423-1500-493e-b6ae-fefc0095b767
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023 · Mandiant Fortinet Zero DayATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e76f8463-45ca-489b-86e8-ee854c2a0f71
Mandiant FIN13 Aug 2022ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f16c18f0-c5ac-4ea2-bfd0-222e63c09018
PWC Cloud Hopper April 2017ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f43de92c-7a30-4d24-82d1-4537d4fc3fb2
Mandiant_UNC2165ATTACK:enterprise:T1021.004 → subtechnique-of → ATTACK:enterprise:T1021
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8c320cc-97f5-4b3a-8847-92c42b6a48b7
ATTACK:enterprise:G0106 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa69ac7a-8031-4fac-91e2-65e90f378cd1
Anomali Rocke March 2019ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1021.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fe8bc44b-805d-440c-a447-96091033439d
FireEye APT39 Jan 2019