DFIRHub

Windows event log ยท OpenSSH/Admin2 SSH error

Win32-OpenSSH logs critical (event id 1) and error (event id 2) messages to OpenSSH/Admin, and the rest to OpenSSH/Operational

  • Remote access
  • 2 fields
  • OpenSSH%4Admin.evtx
  • OpenSSH

Fields EvtxECmd extracts

2 columns in the EvtxECmd CSV

  • PayloadData1%Process%
    • %Process% = /Event/EventData/Data[@Name="process"]
  • PayloadData2%Payload%
    • %Payload% = /Event/EventData/Data[@Name="payload"]

Sample event

Event XML from the map file

<EventData>
  <Data Name="process">sshd</Data>
  <Data Name="payload">error: connect to 192.168.21.12 port 445 failed: No error</Data>
</EventData>
</Event>

References

1 link

Source: evtx/Maps/OpenSSH-Admin_OpenSSH_2.map(opens in new tab) by Eric Zimmerman and contributors(opens in new tab), MIT License(opens in new tab)