MITRE ATT&CK technique · Persistence, Privilege Escalation

`T1098.004` SSH Authorized Keys

Sub-technique of T1098 Account Manipulation

Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The authorized_keys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured.…

MITRE ATT&CK page ↗

Who uses it · with stories on Jábega

GhostEmperor
Earth Lusca

Sigma rules to hunt it

SigmaHQ has no rules for this technique.

Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.