AN0350
Analytic 0350
Linux
Adversary attempts to gain persistence by modifying ~/.ssh/authorized_keys via shell, text editor, echo or redirected output.
auditd:SYSCALL
write | PATH=/home/*/.ssh/authorized_keys
auditd:SYSCALL
execve
[TimeWindow]
Temporal window to correlate file writes and suspicious process launches (e.g., <60s)
[UserContext]
Expected user-to-process correlation (e.g., root writing to non-root authorized_keys)
[TargetPath]
Custom SSH path or user home variation (e.g., /etc/skel/.ssh/)
AN0351
Analytic 0351
macOS
Insertion of public keys into authorized_keys using bash/zsh or editor tools, correlated with suspicious process ancestry.
macos:unifiedlog
process: exec + filewrite: ~/.ssh/authorized_keys
macos:auth
~/.ssh/authorized_keys
[ParentProcess]
Track unusual parent process writing to SSH config (e.g., curl -> bash)
[InteractiveSessionFlag]
Flag whether shell session was interactive (normal) or spawned remotely (potential abuse)
AN0352
Analytic 0352
IaaS
Abuse of cloud metadata APIs or CLI to push SSH public keys to authorized_keys of virtual machines.
gcp:audit
compute.instances.setMetadata
[MetadataFieldName]
Custom metadata field (e.g., ssh-keys or custom-key)
[AccountType]
Was it an admin, service principal, or automation user initiating?
[TargetRoleEscalation]
Privilege level of the VM account receiving the key
AN0353
Analytic 0353
ESXi
Direct modification of /etc/ssh/keys-<user>/authorized_keys or enabling SSH in sshd_config to support public key auth.
esxi:shell
file write or edit
[SSHConfigPath]
Could be modified SSH path in hypervisor
[ESXiShellActivity]
Whether shell was enabled beforehand via DCUI or API
AN0354
Analytic 0354
Network Devices
Use of command-line like `ip ssh pubkey-chain` to bind SSH keys to privileged accounts on routers or switches.
networkdevice:cli
ip ssh pubkey-chain
[CLIUserRole]
Was the role allowed to push persistent config changes?
[DeviceModel]
Variations in syntax or log behavior across device OS