ssh.exe

ssh.exe is the Windows port of the OpenSSH client. It connects to SSH servers to start interactive shells, run single commands (ssh host command), copy files, and set up port forwarding and proxy tunnels. It ships with Windows 10 and later as an optional-but-default feature, with the genuine binary at C:\Windows\System32\OpenSSH\ssh.exe.

Legitimately, ssh is used by administrators and developers to reach remote systems. Where it connects, what it runs, and any tunneling it sets up are what give an instance meaning.

ssh.exe supports lateral movement and remote execution (T1021.004). With keys or stolen credentials, an operator opens shells on other machines or runs one-off commands, blending with normal administration. Its forwarding options (-L, -R, -D) build tunnels that pivot traffic through compromised hosts and bypass network controls, which is often the more important signal than the login itself.

ssh can also run a local program as a side effect: the ProxyCommand and local-command options execute a command on the source machine, a form of indirect command execution through a signed binary (T1202). Because ssh is legitimate, the destinations, the forwarding flags, and any local-command options are what separate administration from pivoting and abuse.