Techniques › T1098.004 › AN0350
AN0350 Analytic 0350
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Adversary attempts to gain persistence by modifying ~/.ssh/authorized_keys via shell, text editor, echo or redirected output.</p>
- Detects
- T1098.004 SSH Authorized Keys
- Part of
- DET0126 Detection Strategy for SSH Key Injection in Authorized Keys
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | write | PATH=/home/*/.ssh/authorized_keys | DC0061 File Modification |
| auditd:SYSCALL | execve | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
TimeWindow | Temporal window to correlate file writes and suspicious process launches (e.g., <60s) |
UserContext | Expected user-to-process correlation (e.g., root writing to non-root authorized_keys) |
TargetPath | Custom SSH path or user home variation (e.g., /etc/skel/.ssh/) |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2022-40684 | Fortinet Multiple Products | Mapped |