DFIRHub

Windows event log · OpenSSH/Operational4 SSH activity

  • Remote access
  • 2 fields
  • OpenSSH%4Operational.evtx
  • OpenSSH

Fields EvtxECmd extracts

2 columns in the EvtxECmd CSV

  • PayloadData1%Process%
    • %Process% = /Event/EventData/Data[@Name="process"]
  • PayloadData2%Payload%
    • %Payload% = /Event/EventData/Data[@Name="payload"]

Sample event

Event XML from the map file

<System>
  <Provider Name="OpenSSH" Guid="{c4b57d35-0636-4bc3-a262-370f249f9802}"/>
  <EventID>4</EventID>
  <Version>0</Version>
  <Level>4</Level>
  <Task>0</Task>
  <Opcode>0</Opcode>
  <Keywords>0x4000000000000000</Keywords>
  <TimeCreated SystemTime="2019-11-13T00:21:44.657927700Z"/>
  <EventRecordID>30</EventRecordID>
  <Correlation/>
  <Execution ProcessID="6960" ThreadID="6136"/>
  <Channel>OpenSSH/Operational</Channel>
  <Computer>Thunder.cloud.corp.com</Computer>
  <Security UserID="S-1-5-18"/>
</System>
<EventData>
  <Data Name="process">sshd</Data>
  <Data Name="payload">Accepted password for cloud\\thor from 2001:4358:95:100b:3e33:3247:ad99:c756 port 52443 ssh2</Data>
</EventData>
</Event>

Source: evtx/Maps/OpenSSH-Operational_OpenSSH_4.map(opens in new tab) by Troy Larson and contributors(opens in new tab), MIT License(opens in new tab)