GitHub - issacnitin/SshSessionMonitor: SSH Session Monitoring for Windows
SSH Session Monitor
[](https://github.com/issacnitin/SshSessionMonitor#ssh-session-monitor) SSH Session Monitor is a free, open source Windows console application written in C# that passively monitors Microsoft OpenSSH Server through the Windows event log to:
- Show every established SSH connection with user, source address, duration, and owning process
- Reconstruct each session's commands and PowerShell transcript output in a live terminal view
- Correlate disjoint event sources (OpenSSH, Security, Sysmon, PowerShell) into single sessions by process generation and logon ID
- Persist normalized events to SQLite in WAL mode, committing bookmarks with each event so restarts resume cleanly
- Report capture gaps when an audit or logging policy required for command and output capture is missing
SSH Session Monitor is strictly read-only. It works with your existing OpenSSH Server, so no alternative SSH daemon, proxy, bastion, or in-session agent is required. It never intercepts keystrokes, captures credentials, injects into processes, or terminates sessions.
Requirements
[](https://github.com/issacnitin/SshSessionMonitor#requirements)
- Windows 10/11 or Windows Server 2019+
- .NET 8 SDK to build
- Microsoft OpenSSH Server
- Administrator access to read the Security event log
The application requests elevation explicitly at startup and exits if elevation is declined.
Install
[](https://github.com/issacnitin/SshSessionMonitor#install) Download the latest single-file executable from the releases page and run it. No .NET runtime installation is required.
Build and run
[](https://github.com/issacnitin/SshSessionMonitor#build-and-run)
dotnet restore .\SshSessionMonitor.sln dotnet build .\SshSessionMonitor.sln -c Release dotnet test .\SshSessionMonitor.sln -c Release dotnet run --project .\src\SshSessionMonitor.App\SshSessionMonitor.App.csproj
To produce the same self-contained executable that CI publishes:
dotnet publish .\src\SshSessionMonitor.App\SshSessionMonitor.App.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true -p:EnableCompressionInSingleFile=true -p:DebugType=none -o .\publish
Application data is stored in `%LOCALAPPDATA%\SSH Session Monitor\monitor.db`. SQLite runs in WAL mode. Event bookmarks are committed in the same transaction as their normalized event so restart resumes after the last durable record.
Event sources
[](https://github.com/issacnitin/SshSessionMonitor#event-sources)
- `OpenSSH/Operational`: accepted and failed authentication
- `Security` 4624, 4625, and 4688: LUID and process creation
- `Microsoft-Windows-Sysmon/Operational` 1 and 5: preferred process start/exit telemetry
- `Microsoft-Windows-PowerShell/Operational` 4104: script blocks
- IPHlpAPI `GetExtendedTcpTable`: established connections owned by `sshd.exe`
The footer reports whether command and output capture prerequisites are ready. The application never changes machine policy.
Useful setup commands are:
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 Start-Service sshd Set-Service sshd -StartupType Automatic
auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable
New-Item -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Force Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name ProcessCreationIncludeCmdLine_Enabled -Type DWord -Value 1
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Force Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name EnableScriptBlockLogging -Type DWord -Value 1
New-Item -ItemType Directory -Path 'C:\ProgramData\SSH Session Monitor\Transcripts' -Force New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription' -Force Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription' -Name EnableTranscripting -Type DWord -Value 1 Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription' -Name EnableInvocationHeader -Type DWord -Value 1 Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription' -Name OutputDirectory -Value 'C:\ProgramData\SSH Session Monitor\Transcripts'
New-Item -Path 'HKLM:\SOFTWARE\OpenSSH' -Force Set-ItemProperty -Path 'HKLM:\SOFTWARE\OpenSSH' -Name DefaultShell -Value 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'
Sysmon installation and configuration should follow the organization's approved Sysmon policy. Without Sysmon or Security 4688 command-line policy, command capture is reduced. Without PowerShell 4104, cmdlets that create no child process are not observable. All missing sources and ingestion overflow/errors are recorded and shown as capture gaps.
Operation
[](https://github.com/issacnitin/SshSessionMonitor#operation)
- `Tab`: switch focus between connections and command/output.
- `Up` / `Down`: select a connection or scroll focused output line-by-line.
- `PageUp` / `PageDown`: scroll command/output by page.
- `End`: return to the live tail.
- `R`: refresh capture readiness.
- `Q` or `Ctrl+C`: exit.
- The upper pane shows one row per established SSH TCP endpoint.
- The lower pane renders `PS> command` followed by transcript output.
Security 4688 or Sysmon captures process command lines. PowerShell transcription is required for output because event logs do not contain stdout/stderr. Transcript files are matched to sessions by process ID, not username.
Scope
[](https://github.com/issacnitin/SshSessionMonitor#scope) The terminal UI is read-only. It does not intercept keystrokes, capture credentials, inject into processes, terminate SSH sessions, or collect from remote machines.
Test fixtures under `tests/SshSessionMonitor.Core.Tests/Fixtures` are sanitized XML exported from representative EVTX records. Tests cover parser behavior, PID reuse, and out-of-order process arrival.