SSH Authorized Keys Modification by Script

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•4

Detects non-standard scripts altering the authorized_keys file to inject attacker SSH public keys, providing persistent backdoor access to the compromised machine. Specifically looks for modifications or creations of 'authorized_keys' files by 'node', 'python', or 'bun' processes.