[DevCop95]

Summary of Changes

Adds the KnownHostsCommand indirect execution technique to yml/OSBinaries/Ssh.yml (T1202).

KnownHostsCommand specifies a local program to invoke to retrieve host keys during the SSH key exchange handshake. In Windows OpenSSH, this directive executes locally prior to user authentication and does not require PermitLocalCommand=yes.

Adversary Usecase & Threat Context

• Technique / Objective: Defense Evasion & Indirect Command Execution (MITRE ATT&CK: T1202 - Indirect Command Execution).
• Unlike LocalCommand (which strictly requires PermitLocalCommand=yes and executes only after successful session authentication), KnownHostsCommand triggers during the initial host key lookup phase as soon as an SSH banner and host key are received from the remote target.
• Execution occurs locally regardless of whether user credentials are supplied, whether authentication succeeds or fails, or whether the remote host key is trusted.
• The command executes under the user context running ssh.exe, proxying command execution through the legitimate Microsoft-signed client. Note that Windows OpenSSH requires an absolute binary path (e.g. C:\Windows\System32\cmd.exe) when specifying the command.

Detection & Telemetry

• Sysmon Event ID 1 / Windows Security Event ID 4688 (Process Creation): Execution of ssh.exe containing KnownHostsCommand in command-line arguments.
• Process Lineage / Pre-Auth Ancestry: Telemetry monitoring for ssh.exe spawning child command interpreters (cmd.exe, powershell.exe) during network connection setup before authentication completes. Tracking this relationship also detects execution when KnownHostsCommand is supplied via an SSH configuration file (-F or %USERPROFILE%.ssh\config), which omits the option from the command line.

Attribution & References

• Technique Discovery & Defensive Modeling: Yared Henriquez (@DevCop95).
• Official OpenSSH Documentation: OpenSSH ssh_config(5) - KnownHostsCommand.

Verification & Environment Tested

• Tested on: Windows 11 Pro (Build 10.0.26300) and Windows 10 with OpenSSH_for_Windows_9.5p2.
• Execution Context: Tested against both responsive SSH endpoints and local mock transports. Confirmed that execution requires an absolute binary path, executes pre-authentication, and completes even upon connection rejection or invalid credentials.
• Schema Validation: Conforms strictly to LOLBAS YAML schema specifications.
• CI Pre-checks: Verified locally against .github/workflows/validation.py (Pydantic validation passed cleanly) and .github/.yamllint (yamllint passed with 0 errors/warnings).