title: SSH authorized_keys Modified
id: 7b3de344-3b50-4dd0-ac29-3062715ab1c7
status: experimental
description: Detects writes to an authorized_keys file recorded by an auditd write/attribute watch.
author: WMouton
date: 2026/10/04
tags:
    - attack.persistence
    - attack.t1098.004
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'PATH'
        name|endswith: '/.ssh/authorized_keys'
    condition: selection
falsepositives:
    - Configuration management and provisioning tools that manage keys
    - Administrators adding keys for new staff
level: medium

# companion auditd watch rules (required, the Sigma rule only reads what these record):
# -w /root/.ssh/authorized_keys -p wa -k ssh_keys
# -w /home -p wa -k ssh_keys   (narrow to the authorized_keys files you care about)