Linux SSH Public Key Authentication Observed

Lucas Pinho@lucaslapinho

•updated Aug 17, 2026•1•0•4

Detects successful SSH authentication to a Linux system using public-key authentication by monitoring system logs for the 'Accepted publickey for' message. This rule identifies remote access attempts and serves as a foundation for monitoring lateral movement via SSH.