CVE-2020-14145

Sentinel/Defender KQL

DeviceNetworkEvents
| where InitiatingProcessFileName has "ssh" or InitiatingProcessCommandLine has "ssh"
| where ActionType == "ConnectionAttempt"
| where RemotePort == 22
| summarize ConnectionCount = count() by DeviceName, InitiatingProcessCommandLine, RemoteIP
| where ConnectionCount > 5 // Adjust threshold as needed for unusual connection attempts
| join kind=leftouter (
    DeviceFileEvents
    | where FileName has "known_hosts"
    | summarize LastModified = max(Timestamp) by DeviceName, FolderPath
) on DeviceName
| where isempty(LastModified) or LastModified < ago(7d) // Potentially new or rarely updated known_hosts, indicating initial connections

Splunk SPL

(sourcetype=linux_secure OR sourcetype=syslog) (program=sshd OR program=ssh) "connection from" OR "Host key verification failed"
| stats count by host, user, src_ip, _time
| where count > 5 // Adjust threshold for unusual connection attempts
| join type=left (
    (sourcetype=linux_audit OR sourcetype=syslog) (file="known_hosts" AND action=modified)
    | stats max(_time) as known_hosts_last_modified by host
) on host
| where isnull(known_hosts_last_modified) OR known_hosts_last_modified < relative_time(now(), "-7d")

Sigma

title: OpenSSH Client Info Leak Attempt
id: 00000000-0000-0000-0000-0000000014145
status: experimental
description: Detects potential attempts to exploit CVE-2020-14145 in OpenSSH clients by looking for unusual SSH connection patterns or host key verification failures, especially on initial connections.
author: SecBoard
date: 2023/10/27
logsource:
  product: linux
  service: auditd
detection:
  selection:
    - 'syscall=connect'
    - 'comm="ssh"'
    - 'daddr!=127.0.0.1'
    - 'dport=22'
  condition: selection | count() by src_ip, daddr > 5
falsepositives:
  - Legitimate new SSH connections to multiple hosts
level: medium

Elastic ES|QL

from network where process.name : "ssh" and destination.port == 22 and event.type == "start" and not destination.ip : ("127.0.0.1", "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
| stats connection_count = count() by host.name, process.command_line, destination.ip
| where connection_count > 5
| join {
    from file where file.path : "*known_hosts*" and event.type == "change"
    | stats last_modified = max(event.timestamp) by host.name
} on host.name
| where is_null(last_modified) or last_modified < now() - INTERVAL 7 DAY