Sunturai
Back to results
InformationalSplunk security contentMichael Haag +1

Linux SSH Authorized Keys Modification

The following analytic detects the modification of SSH Authorized Keys on Linux systems. It leverages process execution data from Endpoint Detection and Response (EDR) agents, specifically monitoring commands like…

Description

The following analytic detects the modification of SSH Authorized Keys on Linux systems. It leverages process execution data from Endpoint Detection and Response (EDR) agents, specifically monitoring commands like "bash" and "cat" interacting with "authorized_keys" files. This activity is significant as adversaries often modify SSH Authorized Keys to establish persistent access to compromised endpoints. If confirmed malicious, this behavior could allow attackers to maintain unauthorized access, bypassing traditional authentication mechanisms and potentially leading to further exploitation or data exfiltration.

Detection logic

Detection requirements

Platform
ESXiIaaSLinuxmacOSNetwork Devices

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
sysmon_for_linux_eventid_1

Known benign triggers

  • Filtering will be required as system administrators will add and remove. One way to filter query is to add "echo".

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice