Redis process modifying SSH authorized_keys via AOF abuse

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•4

This rule detects suspicious activity associated with Redis server processes attempting to write to SSH 'authorized_keys' files or executing commands (such as BGREWRITEAOF or directory reconfiguration) commonly used by attackers to inject malicious SSH public keys into a Redis installation for persistent remote access.