Adversary attempts to gain persistence by modifying ~/.ssh/authorized_keys via shell, text editor, echo or redirected output.
| Data Component | Name | Channel |
|---|---|---|
| File Modification (DC0061) | auditd:SYSCALL | write | PATH=/home/*/.ssh/authorized_keys |
| Process Creation (DC0032) | auditd:SYSCALL | execve |
| Field | Description |
|---|---|
| TimeWindow | Temporal window to correlate file writes and suspicious process launches (e.g., <60s) |
| UserContext | Expected user-to-process correlation (e.g., root writing to non-root authorized_keys) |
| TargetPath | Custom SSH path or user home variation (e.g., /etc/skel/.ssh/) |
Insertion of public keys into authorized_keys using bash/zsh or editor tools, correlated with suspicious process ancestry.
| Data Component | Name | Channel |
|---|---|---|
| Process Creation (DC0032) | macos:unifiedlog | process: exec + filewrite: ~/.ssh/authorized_keys |
| File Modification (DC0061) | macos:auth | ~/.ssh/authorized_keys |
| Field | Description |
|---|---|
| ParentProcess | Track unusual parent process writing to SSH config (e.g., curl -> bash) |
| InteractiveSessionFlag | Flag whether shell session was interactive (normal) or spawned remotely (potential abuse) |
Abuse of cloud metadata APIs or CLI to push SSH public keys to authorized_keys of virtual machines.
| Data Component | Name | Channel |
|---|---|---|
| File Modification (DC0061) | gcp:audit | compute.instances.setMetadata |
| Field | Description |
|---|---|
| MetadataFieldName | Custom metadata field (e.g., ssh-keys or custom-key) |
| AccountType | Was it an admin, service principal, or automation user initiating? |
| TargetRoleEscalation | Privilege level of the VM account receiving the key |
Direct modification of /etc/ssh/keys-
| Data Component | Name | Channel |
|---|---|---|
| File Modification (DC0061) | esxi:shell | file write or edit |
| Field | Description |
|---|---|
| SSHConfigPath | Could be modified SSH path in hypervisor |
| ESXiShellActivity | Whether shell was enabled beforehand via DCUI or API |
Use of command-line like ip ssh pubkey-chain to bind SSH keys to privileged accounts on routers or switches.
| Data Component | Name | Channel |
|---|---|---|
| Command Execution (DC0064) | networkdevice:cli | ip ssh pubkey-chain |
| Field | Description |
|---|---|
| CLIUserRole | Was the role allowed to push persistent config changes? |
| DeviceModel | Variations in syntax or log behavior across device OS |