1200KM / detection
T1098.004 SSH Authorized Keys — Detection Rules
Detection workspace for T1098.004 SSH Authorized Keys: 0 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
No reviewed association in this snapshot.
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0126 Detection Strategy for SSH Key Injection in Authorized Keys
AN0350 Analytic 0350
Adversary attempts to gain persistence by modifying ~/.ssh/authorized_keys via shell, text editor, echo or redirected output.
AN0351 Analytic 0351
Insertion of public keys into authorized_keys using bash/zsh or editor tools, correlated with suspicious process ancestry.
AN0352 Analytic 0352
Abuse of cloud metadata APIs or CLI to push SSH public keys to authorized_keys of virtual machines.
AN0353 Analytic 0353
Direct modification of /etc/ssh/keys-/authorized_keys or enabling SSH in sshd_config to support public key auth.
AN0354 Analytic 0354
Use of command-line like `ip ssh pubkey-chain` to bind SSH keys to privileged accounts on routers or switches.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1098.004 simulation workspace
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.