[DevCop95]

Closes #526

Summary

Adds the PermitLocalCommand=yes and LocalCommand indirect execution technique to ssh.exe (T1202), as reported by @wdormann in issue #526 based on Microsoft Threat Intelligence's analysis of the Star Blizzard (Redflick campaign).

What was added

• Commands:
  • ssh.exe -o "StrictHostKeyChecking=no" -o "PermitLocalCommand=yes" -o "LocalCommand=cmd.exe /q /c {CMD}" -q user@host
  • Category: Execute
  • MitreID: T1202
• Detection:
  • Process creation monitoring for PermitLocalCommand and LocalCommand command-line flags.
  • Telemetry for unexpected child processes spawned by ssh.exe (cmd.exe, powershell.exe, msiexec.exe).
• Resources:
  • Official Microsoft Threat Intelligence publication on Star Blizzard / Redflick malware delivery.
• Acknowledgements:
  • Will Dormann (@wdormann)
  • Yared Henriquez (@DevCop95)

Validation

• Validated locally against the project's official Pydantic harness (.github/workflows/validation.py):

  SUCCESS: Ssh.yml is 100% valid according to LOLBAS MainModel schema!