3BB: SSH authorized_keys backdoor with repeated probing pattern

Arnold Chan@slaz

•updated Sep 15, 2026•0•0•2

This rule detects modifications or creation of the SSH 'authorized_keys' file, often used to establish unauthorized persistent access via SSH key-based authentication. It monitors both file system changes and command-line execution patterns involving SSH key injection commands (e.g., echo, cat, redirection) while filtering out known management agent activity.