SIM EDR 005

CortexSim

Detection simulation engine for Palo Alto Networks Cortex

---

SIM-EDR-005 — Lateral Movement — SSH Abuse, Tunneling, and Internal Recon

Plane: EDR · Status: active · Version: 1.0 · Source: scenarios/edr/edr-005-lateral-movement.yml

Identity & alignment

Use case	UCS-EDR-05 — Lateral Movement Detection
Test case	TC-EDR-05 — SSH-Based Lateral Movement and Network Tunneling
MITRE tactic	TA0008 — Lateral Movement
MITRE technique	T1021.004 — Remote Services: SSH
Additional techniques	T1046 Network Service Discovery, T1572 Protocol Tunneling, T1018 Remote System Discovery
Detection types	BIOC, Analytics
Threat report	Unit42 - Linux Threat Landscape Report 2024 · link
Execution identities	www-data, root, svc-backup, postgres
Push supported	✅
Pull supported	✅
External tools	—
Tags	lateral-movement, ssh, tunneling, port-scan, network-recon, endpoint-security

Expected detections (8)

Step	Plane	Type	Description
step-01	EDR	Analytics	Network interface and routing enumeration from service account — internal recon preceding lateral movement
step-02	EDR	BIOC	Port scanning via bash /dev/tcp — network service discovery from web service account
step-02	EDR	Analytics	Sequential port connection attempts across multiple services — automated service enumeration
step-03	EDR	BIOC	SSH connection attempt from service account — lateral movement via remote service
step-03	EDR	Analytics	Batch-mode SSH with StrictHostKeyChecking disabled — automated lateral movement tool behavior
step-04	EDR	BIOC	SSH tunnel creation (-L/-D flags) — protocol tunneling for covert channel establishment
step-04	EDR	Analytics	SSH invoked with port forwarding from service account — data exfiltration channel pattern
step-05	EDR	Analytics	DNS and host file enumeration from service account — remote system discovery for lateral movement planning

Run it

# Pull mode — Go beacon agent polls SimCore for this scenario
./bin/cortexsim-agent --server http://localhost:8888 --scenario SIM-EDR-005

# Push mode — generate a self-contained bundle
curl -X POST http://localhost:8888/api/runs \
  -H "Content-Type: application/json" \
  -d '{"scenario_id":"SIM-EDR-005","mode":"push"}'
# then download the generated bundle and execute on the target

Related

• Plane overview: Plane-EDR
• ATT&CK coverage: ATT-CK-Coverage
• Validation workflow: Validation-Workflow

---

_{Author: scenario YAML last_updated field. To modify this page, edit scenarios/edr/edr-005-lateral-movement.yml and resync the wiki.}