Detection of Linux SSH Authorized Keys Modification

Adversaries frequently target the Linux ~/.ssh/authorized_keys file to establish persistent access to compromised endpoints. By injecting their own public keys into this file, attackers can bypass standard authentication mechanisms and maintain long-term unauthorized access to the system. This technique is often observed as part of broader campaigns involving Living off the Land (LotL) binaries, as well as specific threat activities attributed to malware like Hellcat Ransomware and VoidLink. Defenders must monitor process execution telemetry for common command-line tools interacting with these configuration files to identify potential persistence creation.

Impact

Successful modification of authorized_keys allows an attacker to maintain persistent, high-privilege access to the target host. This unauthorized access can lead to lateral movement, further exploitation, or long-term data exfiltration. The technique is a common component of modern Linux-based threats, including those linked to ransomware operations and cloud-native malware deployments.

Recommendation

Prioritize detection engineering efforts to monitor process execution paths targeting SSH configuration files.

• Deploy the Sigma rule below to monitor for process activity interacting with authorized_keys files.
• Implement filtering to exclude benign system administration activity, such as legitimate key management scripts utilizing 'echo' or 'ssh-keygen'.
• Configure Sysmon for Linux (Event ID 1) to capture full process command lines and parent process information.
• Use the provided drilldown search logic to investigate specific users and destinations associated with detected key modifications.