Red Heron: SSH authorized_keys backdoor entries named backdoor/root-shell (Red Heron)
Detects SSH persistence planted during the Red Heron campaign: authorized_keys file writes under a .ssh folder, correlated with process command lines referencing authorized_keys and the operator's observed key comment naming pattern (backdoor / root-shell).
Microsoft Sentinel (KQL)
