SSH Session Monitor

SSH Session Monitor is a free, open source Windows console application written in C# that passively monitors Microsoft OpenSSH Server through the Windows event log to:

• Show every established SSH connection with user, source address, duration, and owning process
• Reconstruct each session's commands and PowerShell transcript output in a live terminal view
• Correlate disjoint event sources (OpenSSH, Security, Sysmon, PowerShell) into single sessions by process generation and logon ID
• Persist normalized events to SQLite in WAL mode, committing bookmarks with each event so restarts resume cleanly
• Report capture gaps when an audit or logging policy required for command and output capture is missing

SSH Session Monitor is strictly read-only. It works with your existing OpenSSH Server, so no alternative SSH daemon, proxy, bastion, or in-session agent is required. It never intercepts keystrokes, captures credentials, injects into processes, or terminates sessions.

Requirements

• Windows 10/11 or Windows Server 2019+
• .NET 8 SDK to build
• Microsoft OpenSSH Server
• Administrator access to read the Security event log

The application requests elevation explicitly at startup and exits if elevation is declined.

Install

Download the latest single-file executable from the releases page and run it. No .NET runtime installation is required.

Build and run

dotnet restore .\SshSessionMonitor.sln
dotnet build .\SshSessionMonitor.sln -c Release
dotnet test .\SshSessionMonitor.sln -c Release
dotnet run --project .\src\SshSessionMonitor.App\SshSessionMonitor.App.csproj

To produce the same self-contained executable that CI publishes:

dotnet publish .\src\SshSessionMonitor.App\SshSessionMonitor.App.csproj -c Release -r win-x64 --self-contained true -p:PublishSingleFile=true -p:IncludeNativeLibrariesForSelfExtract=true -p:EnableCompressionInSingleFile=true -p:DebugType=none -o .\publish

Application data is stored in %LOCALAPPDATA%\SSH Session Monitor\monitor.db. SQLite runs in WAL mode. Event bookmarks are committed in the same transaction as their normalized event so restart resumes after the last durable record.

Event sources

• OpenSSH/Operational: accepted and failed authentication
• Security 4624, 4625, and 4688: LUID and process creation
• Microsoft-Windows-Sysmon/Operational 1 and 5: preferred process start/exit telemetry
• Microsoft-Windows-PowerShell/Operational 4104: script blocks
• IPHlpAPI GetExtendedTcpTable: established connections owned by sshd.exe

The footer reports whether command and output capture prerequisites are ready. The application never changes machine policy.

Useful setup commands are:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Start-Service sshd
Set-Service sshd -StartupType Automatic

auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable

New-Item -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Force
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' -Name ProcessCreationIncludeCmdLine_Enabled -Type DWord -Value 1

New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Force
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging' -Name EnableScriptBlockLogging -Type DWord -Value 1

New-Item -ItemType Directory -Path 'C:\ProgramData\SSH Session Monitor\Transcripts' -Force
New-Item -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription' -Force
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription' -Name EnableTranscripting -Type DWord -Value 1
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription' -Name EnableInvocationHeader -Type DWord -Value 1
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\Transcription' -Name OutputDirectory -Value 'C:\ProgramData\SSH Session Monitor\Transcripts'

New-Item -Path 'HKLM:\SOFTWARE\OpenSSH' -Force
Set-ItemProperty -Path 'HKLM:\SOFTWARE\OpenSSH' -Name DefaultShell -Value 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe'

Sysmon installation and configuration should follow the organization's approved Sysmon policy. Without Sysmon or Security 4688 command-line policy, command capture is reduced. Without PowerShell 4104, cmdlets that create no child process are not observable. All missing sources and ingestion overflow/errors are recorded and shown as capture gaps.

Operation

• Tab: switch focus between connections and command/output.
• Up / Down: select a connection or scroll focused output line-by-line.
• PageUp / PageDown: scroll command/output by page.
• End: return to the live tail.
• R: refresh capture readiness.
• Q or Ctrl+C: exit.
• The upper pane shows one row per established SSH TCP endpoint.
• The lower pane renders PS> command followed by transcript output.

Security 4688 or Sysmon captures process command lines. PowerShell transcription is required for output because event logs do not contain stdout/stderr. Transcript files are matched to sessions by process ID, not username.

Scope

The terminal UI is read-only. It does not intercept keystrokes, capture credentials, inject into processes, terminate SSH sessions, or collect from remote machines.

Test fixtures under tests/SshSessionMonitor.Core.Tests/Fixtures are sanitized XML exported from representative EVTX records. Tests cover parser behavior, PID reuse, and out-of-order process arrival.