Account Manipulation: SSH Authorized Keys `T1098.004`

Tactics: Persistence, Privilege Escalation

Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The authorized_keys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under <user-home>/.ssh/authorized_keys (or, on ESXi, `/etc/ssh/keys-<username>/authorized_keys`). Users may edit the system’s SSH config file to modify the directives `PubkeyAuthentication` and `RSAAuthentication` to the value `yes` to ensure public key and RSA authentication are enabled, as well as modify the directive `PermitRootLogin` to the value `yes` to enable root authentication via SSH. The SSH config file is usually located under /etc/ssh/sshd_config.

Events covered

4 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Linux-Auditd	Event ID 1302	PATH
Linux-Auditd	Event ID 1307	CWD
Sysmon-for-Linux	Event ID 1	Process Create
Sysmon-for-Linux	Event ID 11	File created

Authoring guide

These 13 rules share fields, values, and exclusions.

Fields filtered most (20 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	6	`in` 4, `eq` 2	`exec`, `ProcessRollup2`, `creation`, `exec_event`, `file_create_event`
`host.os.type`	5	`eq` 5
`event.type`	4	`eq` 2, `in` 2	`change`, `creation`, `start`
`process_name`	4	`in` 4, `eq` 1	`bash`, `cat`, `csh`, `ctl`, `dash`
`CommandLine`	3	`contains` 1, `ends_with` 1, `wildcard` 1	`* nc `, ` nc.traditional `, ` ncat *`, `/authorized_keys`, `/etc/ssh/sshd_config`
`TargetFilename`	3	`wildcard` 2, `contains` 1	`/.ssh`, `/boot/efi/efi//grub.cfg`, `/boot/grub/grub.cfg`, `/boot/grub2/grub.cfg`, `/etc/ssh/`
`data_stream.dataset`	3	`eq` 3	`aws.cloudtrail`, `fim.event`, `network_traffic.redis`
`container.id`	2	`starts_with` 1, `wildcard` 1	`*`, `?`
`event.category`	2	`eq` 2	`authentication`, `file`
`event.outcome`	2	`eq` 2	`success`
`file.name`	2	`in` 2	`authorized_keys`, `authorized_keys2`
`process.args`	2	`in` 2, `contains` 1, `eq` 1, `wildcard` 1	`* /dev/shm/` , ` /home/`, ` /run/*`, `--`, `--restart=Never`
`Image`	1	`eq` 1	`/usr/bin/ssh-keygen`
`Provider_Name`	1	`eq` 1	`ec2-instance-connect.amazonaws.com`
`match_count`	1	`gt` 1	`0`

Top indicator values (316 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`TargetFilename`	`wildcard`	`/etc/ssh/*` elasticPotential Persistence via File Modification elasticSSH Key Generated via ssh-keygen	2	2
`TargetFilename`	`wildcard`	`/home//.ssh/` elasticPotential Persistence via File Modification elasticSSH Key Generated via ssh-keygen	2	2
`TargetFilename`	`wildcard`	`/root/.ssh/*` elasticPotential Persistence via File Modification elasticSSH Key Generated via ssh-keygen	2	2
`event.outcome`	`eq`	`success` elasticAWS EC2 Instance Connect SSH Public Key Uploaded elasticUnusual Login via System User	2	375
`event.type`	`eq`	`start` elasticPod or Container Creation with Suspicious Command-Line elasticSuspicious Echo or Printf Execution Detected via Defend for Containers	2	1087
`event.type`	`in`	`change` elasticSSH Authorized Key File Activity Detected via Defend for Containers elasticSSH Authorized Keys File Activity	2	20
`event.type`	`in`	`creation` elasticSSH Authorized Key File Activity Detected via Defend for Containers elasticSSH Authorized Keys File Activity	2	19
`file.name`	`in`	`authorized_keys` elasticSSH Authorized Key File Activity Detected via Defend for Containers elasticSSH Authorized Keys File Activity	2	3
`file.name`	`in`	`authorized_keys2` elasticSSH Authorized Key File Activity Detected via Defend for Containers elasticSSH Authorized Keys File Activity	2	3
`process_name`	`in`	`bash` elasticSuspicious Echo or Printf Execution Detected via Defend for Containers splunkLinux SSH Authorized Keys Modification	2	202
`process_name`	`in`	`cat` splunkLinux Possible Access Or Modification Of sshd Config File splunkLinux SSH Authorized Keys Modification	2	28
`CommandLine`	`contains`	`/authorized_keys` splunkLinux SSH Authorized Keys Modification	1
`CommandLine`	`ends_with`	`/etc/ssh/sshd_config` splunkLinux Possible Access Or Modification Of sshd Config File	1
`CommandLine`	`wildcard`	`* nc *` elasticPod or Container Creation with Suspicious Command-Line	1	7
`CommandLine`	`wildcard`	`* nc.traditional *` elasticPod or Container Creation with Suspicious Command-Line	1
`CommandLine`	`wildcard`	`* ncat *` elasticPod or Container Creation with Suspicious Command-Line	1	2
`CommandLine`	`wildcard`	`* netcat *` elasticPod or Container Creation with Suspicious Command-Line	1	2
`CommandLine`	`wildcard`	`./.` elasticPod or Container Creation with Suspicious Command-Line	1	2
`CommandLine`	`wildcard`	`/boot/` elasticPod or Container Creation with Suspicious Command-Line	1
`CommandLine`	`wildcard`	`/dev/shm/` elasticPod or Container Creation with Suspicious Command-Line	1	9
`CommandLine`	`wildcard`	`/dev/tcp/` elasticPod or Container Creation with Suspicious Command-Line	1	5
`CommandLine`	`wildcard`	`/etc/init.d` elasticPod or Container Creation with Suspicious Command-Line	1	4
`CommandLine`	`wildcard`	`/etc/ld.so` elasticPod or Container Creation with Suspicious Command-Line	1	4
`CommandLine`	`wildcard`	`/etc/profile` elasticPod or Container Creation with Suspicious Command-Line	1	3
`CommandLine`	`wildcard`	`/etc/rc.local` elasticPod or Container Creation with Suspicious Command-Line	1	4
`CommandLine`	`wildcard`	`/etc/shadow` elasticPod or Container Creation with Suspicious Command-Line	1	12
`CommandLine`	`wildcard`	`/etc/ssh` elasticPod or Container Creation with Suspicious Command-Line	1	10
`CommandLine`	`wildcard`	`/etc/sudoers` elasticPod or Container Creation with Suspicious Command-Line	1	4
`CommandLine`	`wildcard`	`/etc/update-motd.d` elasticPod or Container Creation with Suspicious Command-Line	1	4
`CommandLine`	`wildcard`	`/home//.ssh/*` elasticPod or Container Creation with Suspicious Command-Line	1	11

Exclusions (22 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`Image`	`eq`	`/library/developer/commandlinetools/usr/bin/git` elasticSSH Authorized Keys File Activity	1
`Image`	`eq`	`/opt/jc/bin/jumpcloud-agent` elasticSSH Authorized Keys File Activity	1
`Image`	`eq`	`/opt/puppetlabs/puppet/bin/puppet` elasticSSH Authorized Keys File Activity	1
`Image`	`eq`	`/usr/bin/bsdtar` elasticSSH Authorized Keys File Activity	1
`Image`	`eq`	`/usr/bin/chef-client` elasticSSH Authorized Keys File Activity	1
`Image`	`eq`	`/usr/bin/google_guest_agent` elasticSSH Authorized Keys File Activity	1
`Image`	`eq`	`/usr/bin/nautilus` elasticSSH Authorized Keys File Activity	1
`Image`	`eq`	`/usr/bin/scp` elasticSSH Authorized Keys File Activity	1
`Image`	`eq`	`/usr/bin/touch` elasticSSH Authorized Keys File Activity	1
`Image`	`eq`	`/usr/bin/vim` elasticSSH Authorized Keys File Activity	1
`Image`	`starts_with`	`/var/lib/docker/` elasticSSH Authorized Keys File Activity	1
`Image`	`wildcard`	`/library/java/javavirtualmachines/jdk*.jdk/contents/home/bin/java` elasticSSH Authorized Keys File Activity	1
`Image`	`wildcard`	`/usr/local/cellar/coreutils/*/bin/gcat` elasticSSH Authorized Keys File Activity	1
`Image`	`wildcard`	`/usr/local/cellar/maven/*/libexec/bin/mvn` elasticSSH Authorized Keys File Activity	1
`TargetFilename`	`wildcard`	`/home//.ssh/known_hosts.` elasticPotential Persistence via File Modification	1

Rules under this technique

These vendors publish rules tagged with this technique.

Account Manipulation: SSH Authorized Keys `T1098.004`

Events covered

Authoring guide

Fields filtered most (20 distinct)

Top indicator values (316 distinct)

Exclusions (22 distinct)

Rules under this technique

Elastic 9 rules

Splunk 4 rules

Account Manipulation: SSH Authorized Keys T1098.004

Events covered

Authoring guide

Fields filtered most (20 distinct)

Top indicator values (316 distinct)

Exclusions (22 distinct)

Rules under this technique

Elastic 9 rules

Splunk 4 rules

Account Manipulation: SSH Authorized Keys `T1098.004`