T1098.004 SSH Authorized Keys or sshd_config Modification via SCP/SFTP

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects network traffic attempting to modify SSH authorized_keys or the sshd_config file using SCP or SFTP protocols, which is a common technique used by attackers to maintain persistence on compromised systems.