Location Research Breakthrough Possible @S-Logix pro@slogix.in

Office Address

Social List

Detecting and Containing Unauthorized SSH-Based Lateral Movement Across Enterprise OpenSSH Servers Through Authentication Event Correlation and Automated Host Isolation

Description

Enterprise organizations use OpenSSH to provide secure remote administration and server-to-server access across Linux infrastructure.

If an attacker compromises one internal server and obtains valid SSH credentials, the attacker can use OpenSSH to authenticate to additional internal servers. This can allow the attacker to move through the enterprise environment and expand access.

In this use case, a controlled enterprise-like Linux environment is created using multiple Ubuntu virtual machines. OpenSSH is configured on the Linux servers to represent the organization's remote administration infrastructure. Kali Linux is used as the controlled security-testing system.

A controlled SSH-based lateral-movement activity is generated using laboratory credentials. The activity involves authentication from one internal system toward additional internal OpenSSH servers.

Wazuh is deployed to centrally collect and analyze SSH authentication events from the monitored servers. Authentication activity is correlated using source host, destination host, username, authentication result, and event timing.

When the authentication pattern satisfies the configured lateral-movement detection conditions, Wazuh generates a security alert. Wazuh Active Response then performs the configured containment action against the identified source.

The incident is investigated by analyzing the complete SSH authentication sequence. After containment, authorized SSH access is validated and the laboratory environment is restored to its normal state.

Existing Security Problem

Application: OpenSSH

OpenSSH provides remote shell access and secure administration of Linux servers. In an enterprise environment, SSH connections between internal systems may be legitimate. Administrators, automation systems, and service accounts can all generate SSH authentication activity. This makes it difficult to distinguish legitimate administrative access from unauthorized lateral movement when monitoring only individual authentication events.

A compromised account can potentially be used to authenticate to multiple internal OpenSSH servers. If authentication activity is examined independently on each server, the relationship between the different SSH connections may not be immediately visible.

Existing Problem:

A compromised account can potentially be used to authenticate to multiple internal OpenSSH servers. If authentication activity is examined independently on each server, the relationship between the different SSH connections may not be immediately visible.

The security problem is therefore:

Compromised Account → Multiple Internal OpenSSH Servers → Authentication Events → Cross-Host Relationship Hidden → Unauthorized Lateral Movement

The proposed solution introduces centralized OpenSSH authentication monitoring and cross-host event correlation, followed by automated containment when suspicious movement is identified.

Attack

Specific Attack: SSH-Based Lateral Movement

The attack scenario reproduces unauthorized lateral movement through OpenSSH within the controlled laboratory network. A controlled identity is used to authenticate from one laboratory system to another and subsequently access additional internal OpenSSH servers.

The objective is to determine whether the security monitoring system can identify the authentication sequence as lateral movement. Only controlled laboratory systems and credentials are used.

Attack Behavior:
Initial Internal Host
→
Controlled SSH Authentication
→
Internal OpenSSH Server
→
Successful Authentication
→
Additional OpenSSH Server
→
Multi-Host Authentication Pattern
→
Wazuh Event Correlation
→
Lateral Movement Detection
→
Security Alert
→
Automated Host Containment

Security Concept

Authentication Event Correlation for Lateral Movement Detection:

The primary security concept is authentication event correlation.

Instead of analyzing individual SSH authentication events independently, authentication activity is correlated across multiple OpenSSH servers. The detection process considers source IP address, source host, destination server, username, authentication result, authentication timestamp, number of destination servers, authentication sequence, frequency of authentication, and the relationship between source and destination systems.

The secure processing flow is:

OpenSSH Authentication Events
→
Centralized Collection
→
Cross-Host Correlation
→
Authentication Sequence Analysis
→
Suspicious Movement Identified
→
Security Alert
→
Incident Investigation
→
Automated Host Isolation
→
Access Validation

Defensive Mechanism

Centralized OpenSSH Log Monitoring

Authentication logs generated by OpenSSH are collected from the monitored servers.

Purpose

Provide centralized visibility into SSH activity across the environment.

Cross-Host Authentication Correlation

SSH events from multiple OpenSSH servers are correlated based on source, destination, username, and time.

Purpose

Identify movement patterns that cannot be understood from a single server's logs.

Multi-Host Authentication Detection

Repeated authentication from the same source toward multiple internal servers is monitored.

Purpose

Detect suspicious movement across internal systems.

Authentication Sequence Analysis

The order and timing of SSH authentication events are analyzed.

Purpose

Identify unusual sequences of internal server access.

Security Alerting

Wazuh generates a security alert when the configured lateral-movement conditions are satisfied.

Purpose

Provide immediate visibility into suspected lateral movement.

Automated Host Isolation

Wazuh Active Response applies the configured containment action against the identified source.

Purpose

Prevent additional movement from the suspected system.

SSH Access Restriction

SSH connections from the identified malicious source can be temporarily restricted.

Purpose

Stop continued unauthorized OpenSSH access.

Credential Protection

Credentials associated with confirmed suspicious activity can be disabled or rotated.

Purpose

Prevent continued use of compromised credentials.

Post-Containment Validation

SSH activity is monitored after containment.

Purpose

Verify that lateral movement has stopped while legitimate administration remains available.

Security Tools

Primary Detection and Response Tool: Wazuh

Wazuh is the primary security tool because it provides centralized log collection, security-rule processing, event correlation, alerting, and Active Response.

Purpose
  • Collect OpenSSH authentication logs.
  • Monitor multiple Linux servers.
  • Correlate authentication events.
  • Detect suspicious SSH activity.
  • Generate security alerts.
  • Trigger automated response.
  • Support incident investigation.

Application/Service: OpenSSH

OpenSSH is the actual remote-access service being monitored and tested.

Purpose
  • Provide SSH authentication.
  • Generate authentication events.
  • Provide the communication path used for the controlled lateral-movement assessment.
  • Validate SSH access restrictions.

Server Platform: Ubuntu

Ubuntu is used to create the controlled Linux server infrastructure.

Purpose
  • Host OpenSSH.
  • Generate authentication telemetry.
  • Run Wazuh agents.
  • Execute the containment mechanism.

Security Testing Platform: Kali Linux

Kali Linux is used as the controlled security-testing system.

Purpose
  • Generate authorized SSH authentication activity.
  • Perform the controlled lateral-movement assessment.
  • Validate detection and containment.

Virtualization Platform: VirtualBox

VirtualBox provides the isolated infrastructure for the laboratory.

Purpose
  • Create multiple Ubuntu virtual machines.
  • Create the internal server network.
  • Isolate the security-testing environment.

Process

STEP 01

Step 1: Prepare the Virtualized Security Environment

  • Create an isolated cybersecurity laboratory using VirtualBox.
  • Configure multiple Ubuntu virtual machines.
  • Assign separate network identities to the Linux servers.
  • Configure Kali Linux as the security-testing system.
  • Place the systems on an isolated laboratory network.
  • Verify network connectivity between the required systems.
  • Ensure that only controlled accounts and systems are used.
Tools: VirtualBox + Ubuntu + Kali Linux
STEP 02

Step 2: Deploy and Configure OpenSSH

  • Install OpenSSH Server on the Ubuntu systems.
  • Start and enable the OpenSSH service.
  • Configure SSH to listen on the required internal interface.
  • Create controlled laboratory accounts.
  • Configure authorized SSH access between the required systems.
  • Verify normal SSH connectivity.
  • Confirm that OpenSSH authentication events are generated.
Tools: OpenSSH + Ubuntu
STEP 03

Step 3: Establish the Normal OpenSSH Authentication Baseline

  • Perform legitimate SSH authentication between authorized laboratory systems.
  • Generate successful SSH sessions.
  • Generate controlled failed authentication attempts.
  • Record the source and destination systems.
  • Record the usernames used.
  • Review the authentication timestamps.
  • Identify the normal SSH authentication relationships.
Tools: OpenSSH + Ubuntu
STEP 04

Step 4: Deploy Wazuh Agents

  • Perform legitimate SSH authentication between authorized laboratory systems.
  • Generate successful SSH sessions.
  • Generate controlled failed authentication attempts.
  • Record the source and destination systems.
  • Record the usernames used.
  • Review the authentication timestamps.
  • Identify the normal SSH authentication relationships.
Tools: Wazuh + Ubuntu
STEP 05

Step 5: Configure OpenSSH Authentication Detection

  • Review the OpenSSH authentication events received by Wazuh.
  • Identify successful authentication events.
  • Identify failed authentication events.
  • Configure Wazuh rules for suspicious SSH authentication activity.
  • Ensure the required authentication fields are captured.
  • Validate that individual OpenSSH events are correctly processed.
Tools: Wazuh + OpenSSH
STEP 06

Step 6: Configure Lateral-Movement Event Correlation

  • Define the conditions representing suspicious SSH lateral movement.
  • Correlate OpenSSH authentication events across the monitored servers.
  • Track authentication from the same source toward multiple destinations.
  • Associate events using source IP and username.
  • Configure the required authentication time window.
  • Define an appropriate alert severity.
  • Validate the correlation logic using controlled authentication activity.
Tools: Wazuh
STEP 07

Step 7: Generate Controlled SSH Lateral-Movement Activity

  • Begin from the designated laboratory source system.
  • Use the controlled laboratory credentials.
  • Establish an SSH session with the first internal OpenSSH server.
  • Generate subsequent SSH authentication toward another laboratory OpenSSH server.
  • Continue the controlled multi-host authentication sequence.
  • Keep all activity inside the isolated laboratory network.
  • Monitor OpenSSH authentication logs during the activity.
Tools: Kali Linux + OpenSSH + Ubuntu
STEP 08

Step 8: Detect the Lateral-Movement Activity

  • Allow Wazuh agents to collect the generated OpenSSH events.
  • Identify the authentication events generated by the source.
  • Correlate the events across the monitored OpenSSH servers.
  • Identify the destination systems involved.
  • Review the authentication sequence and timestamps.
  • Determine whether the activity satisfies the configured lateral-movement conditions.
Tools: Wazuh
STEP 09

Step 9: Generate the Security Alert

  • Configure Wazuh to generate a high-severity alert when the lateral-movement condition is satisfied.
  • Include the originating source information.
  • Include the destination OpenSSH servers.
  • Include the username involved.
  • Include the authentication results.
  • Include the relevant timestamps.
  • Verify that the alert is automatically generated.
Tools: Wazuh
STEP 10

Step 10: Investigate the Security Alert

  • Open the generated Wazuh alert.
  • Identify the originating system.
  • Identify all destination OpenSSH servers involved.
  • Review the complete authentication sequence.
  • Review the username associated with the activity.
  • Analyze the timing between authentication events.
  • Compare the activity against the established normal baseline.
  • Determine whether the behavior represents unauthorized lateral movement.
Tools: Wazuh + Ubuntu
STEP 11

Step 11: Configure Automated Host Response

  • Configure Wazuh Active Response on the monitored Ubuntu environment.
  • Define the lateral-movement alert as the response trigger.
  • Configure the required containment action.
  • Ensure the response is restricted to the controlled laboratory environment.
  • Test the response mechanism before the final assessment.
  • Verify that Wazuh can execute the configured response successfully.
Tools: Wazuh Active Response + Ubuntu
STEP 12

Step 12: Contain the Lateral Movement

  • Trigger the configured Active Response after the lateral-movement alert.
  • Apply the configured restriction against the identified source.
  • Prevent additional OpenSSH connections from the contained source.
  • Verify that subsequent unauthorized SSH attempts are denied.
  • Confirm that the containment event is recorded by Wazuh.
  • Preserve the authentication logs for investigation.
Tools: Wazuh Active Response + OpenSSH + Ubuntu
STEP 13

Step 13: Protect the Associated Credentials

  • Identify the laboratory credentials associated with the suspicious activity.
  • Disable or rotate the affected credentials.
  • Remove unnecessary SSH authorization.
  • Verify that the protected credentials cannot continue unauthorized authentication.
  • Confirm that authorized administrative credentials remain available.
Tools: Ubuntu + OpenSSH
STEP 14

Step 14: Validate Host Containment

  • Attempt another controlled SSH connection from the contained source.
  • Verify that the connection is denied according to the configured response.
  • Attempt access to the previously targeted OpenSSH servers.
  • Confirm that additional lateral movement is prevented.
  • Review Wazuh for the resulting authentication events.
  • Verify that the containment mechanism remains active.
Tools: Kali Linux + OpenSSH + Wazuh
STEP 15

Step 15: Validate Legitimate OpenSSH Administration

  • Use an authorized laboratory administrator account.
  • Establish a legitimate SSH session from an approved source.
  • Connect to the required Ubuntu server.
  • Verify that legitimate administrative operations remain functional.
  • Confirm that the containment mechanism does not unnecessarily affect approved SSH access.
Tools: OpenSSH + Ubuntu
STEP 16

Step 16: Review the Complete Incident Timeline

  • Review the initial OpenSSH authentication event.
  • Identify subsequent authentication events.
  • Identify the lateral-movement detection event.
  • Identify the generated Wazuh alert.
  • Identify the Active Response execution.
  • Identify the containment event.
  • Review subsequent denied authentication attempts.
  • Correlate the complete incident sequence within Wazuh.
Tools: Wazuh
STEP 17

Step 17: Restore the Laboratory Environment

  • Remove temporary containment restrictions after validation.
  • Restore the required authorized SSH relationships.
  • Restore or rotate laboratory credentials as required.
  • Verify that OpenSSH services are operating normally.
  • Confirm communication between the laboratory servers.
  • Ensure the environment has returned to its normal test configuration.
Tools: Ubuntu + OpenSSH
STEP 18

Step 18: Perform Final Detection and Response Validation

  • Repeat the controlled OpenSSH lateral-movement assessment.
  • Verify that Wazuh detects the multi-host authentication behavior.
  • Verify that the configured security alert is generated.
  • Verify that Active Response is triggered.
  • Confirm that additional lateral movement is prevented.
  • Validate credential protection.
  • Confirm that legitimate SSH administration continues to function.
  • Review the complete Wazuh incident timeline.
  • Verify that all required authentication events are retained.
  • Confirm that the complete detection-to-containment workflow operates successfully.
Tools: Wazuh + OpenSSH + Ubuntu + Kali Linux

Outcome

  1. Unauthorized SSH-based lateral-movement behavior is successfully reproduced within the controlled enterprise-like OpenSSH environment.
  2. OpenSSH authentication activity is centrally collected and monitored across multiple Ubuntu servers using Wazuh.
  3. Authentication events across multiple OpenSSH servers are correlated to identify suspicious internal movement.
  4. Unauthorized multi-host SSH authentication activity is detected using the configured lateral-movement detection conditions.
  5. High-severity security alerts are automatically generated when suspicious lateral movement is identified.
  6. The originating source, destination servers, username, and authentication sequence are identified through centralized Wazuh telemetry.
  7. Wazuh Active Response automatically initiates the configured host-containment mechanism after lateral movement is detected.
  8. Further unauthorized OpenSSH connections from the contained source are prevented, stopping continued lateral movement.
  9. Associated laboratory credentials are protected while legitimate OpenSSH administration remains functional, preventing unnecessary disruption.
  10. The complete OpenSSH lateral-movement detection, authentication correlation, investigation, automated host isolation, credential protection, recovery, and post-containment validation workflow is successfully demonstrated.
← Previous Project
Project 3 of 5
Next Project →