SSH authorized_keys file modified

Threat behaviour covered

An attacker with brief access can add their own public key to ~/.ssh/authorized_keys to keep access without a password. Legitimate changes are rare and usually come from configuration management or a known administrator.

Detection logic

title: SSH authorized_keys Modified
id: 7b3de344-3b50-4dd0-ac29-3062715ab1c7
status: experimental
description: Detects writes to an authorized_keys file recorded by an auditd write/attribute watch.
author: WMouton
date: 2026/10/04
tags:
    - attack.persistence
    - attack.t1098.004
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'PATH'
        name|endswith: '/.ssh/authorized_keys'
    condition: selection
falsepositives:
    - Configuration management and provisioning tools that manage keys
    - Administrators adding keys for new staff
level: medium

# companion auditd watch rules (required, the Sigma rule only reads what these record):
# -w /root/.ssh/authorized_keys -p wa -k ssh_keys
# -w /home -p wa -k ssh_keys   (narrow to the authorized_keys files you care about)

Data sources

• Linux auditd with file watches on authorized_keys files. Without the watch rules there is nothing to match.

False positives and tuning

• Provisioning runs and user onboarding; correlate with the change ticket or the configuration management run.
• Key rotation jobs; allow-list their service accounts.

Limitations

• Watching whole home directories is noisy; scope the watches to the paths that matter. A key placed in a path the SSH daemon is configured to read (AuthorizedKeysFile) outside the watched locations will be missed.