EXPLORE

← Back to Explore

T1098.004

SSH Authorized Keys

Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The <code>authorized_keys</code> file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under <code><user-...

LinuxmacOSIaaSNetwork DevicesESXi

12

Detections

2

Sources

3

Threat Actors

BY SOURCE

8elastic4splunk_escu

PROCEDURES (10)

Remote2 detections

Auto-extracted: 2 detections for remote

C22 detections

Auto-extracted: 2 detections for c2

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Exfiltrat1 detections

Auto-extracted: 1 detections for exfiltrat

Suspicious1 detections

Auto-extracted: 1 detections for suspicious

Service1 detections

Auto-extracted: 1 detections for service

Container1 detections

Auto-extracted: 1 detections for container

Process Creation Monitoring1 detections

Auto-extracted: 1 detections for process creation monitoring

Network Connection Monitoring1 detections

Auto-extracted: 1 detections for network connection monitoring

Privilege1 detections

Auto-extracted: 1 detections for privilege

THREAT ACTORS (3)

Earth Lusca Salt Typhoon TeamTNT

DETECTIONS (12)

AWS EC2 Instance Connect SSH Public Key Uploaded

Linux Auditd Possible Access Or Modification Of Sshd Config File

Linux Possible Access Or Modification Of sshd Config File

Linux Possible Ssh Key File Creation

Linux SSH Authorized Keys Modification

Pod or Container Creation with Suspicious Command-Line

Potential Persistence via File Modification

SSH Authorized Key File Activity Detected via Defend for Containers

SSH Authorized Keys File Activity

SSH Key Generated via ssh-keygen

Suspicious Echo or Printf Execution Detected via Defend for Containers

Unusual Login via System User