Important Detection 2026: SSH Authorized Keys Persistence (T1098.004)

Ibrahim Saud@tektrix

•updated Sep 24, 2026•0•0•2

Detects unauthorized modifications to SSH authorized_keys files. Attackers often modify these files to inject their own public keys, ensuring persistent access to a compromised Linux host. This rule excludes known configuration management and provisioning tools to reduce noise.