Redis process writes/modifies SSH authorized_keys via AOF persistence abuse

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•4

Detects instances where the Redis server process or the Redis AOF check utility writes directly to common SSH authorized_keys file paths. This behavior is indicative of an attacker exploiting a Redis misconfiguration or vulnerability (e.g., Redis RCE) to establish persistence by injecting an unauthorized SSH key.