Loading ATT&CK
Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice
Each is its own technique in the catalogue, with its own detections.
Every one carries the source it came from and the licence it was published under.
| Detection | Severity |
|---|---|
| Renaming of OpenSSH Binaries | Low |
| Potential Remote Desktop Shadowing Activity | High |
| Unusual SSHD Child Process | Low |
| Potential Execution via SSH Backdoor | Medium |
| Network Connection Initiated by Suspicious SSHD Child Process | Medium |
| SSH Key Generated via ssh-keygen | Low |
| Potential THC Tool Downloaded | High |
| SSH Authorized Key File Activity Detected via Defend for Containers | Medium |
| SSH Authorized Keys File Activity | Medium |
Showing 9 of 9