Root SSH password sign-in to GCP servers followed by authorized_keys implant

ills3c Intel&Coffee@Ills3C

•updated today•1•0•3

Detects a root SSH sign-in from a public IP address or known attacker IP, followed within 30 minutes by a write or modification to the root authorized_keys file on the same device.