Modification of an SSH authorized_keys file

1title: Modification of an SSH authorized_keys file2id: 144fb5e9-5944-4542-b3dd-d9143d2ce8683status: experimental4description: |5  AN0350 asks for writes to ~/.ssh/authorized_keys, sourced from auditd, and6  optionally correlated with the process that made them inside a TimeWindow.7  The correlation half is not expressible here — lib/sigma has no timeframe and8  no join — so this rule takes the file-modification leg on its own and matches9  the auditd PATH record for any object whose name contains authorized_keys.10  A contains match rather than an exact one is deliberate: editors and scripted11  writers rarely touch the file in place, they write authorized_keys.tmp or12  .authorized_keys.swp and rename it over the original, and OpenSSH still reads13  authorized_keys2 where a site has kept it, so all of those spellings are the14  same event. The analytic's other leg, process creation, was not used, because15  the most common way an adversary adds a key is an in-shell redirection —16  echo ... >> ~/.ssh/authorized_keys — which is a shell builtin and produces no17  execve record at all, so a process-creation rule would miss the majority case18  while looking tighter.19  The prerequisite matters more than the logic here. auditd emits no PATH record20  for this file unless a rule tells it to watch it, and auditd watches do not21  accept wildcards, so covering every user means a syscall rule over the parent22  directories — something on the order of23  -a always,exit -F arch=b64 -S open,openat,truncate,rename,renameat -F dir=/home24  plus explicit watches for /root/.ssh and /etc/ssh — not a single -w line. With25  no such rule loaded this returns zero rows forever, and zero rows reads as a26  quiet estate when it actually means the sensor is blind. Use -p wa on watches:27  with read permission included, every sshd authentication reads the file and28  this rule matches on every successful login. Finally, the PATH record names the29  file but not the writer; the uid and exe live in the SYSCALL record of the same30  event, so attributing a hit to a process depends on the collector keeping those31  records joined.32  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0126, not hand-written and not tested by its author. Any lab result is on this rule's own page.33references:34  - https://attack.mitre.org/techniques/T1098/00435  - https://attack.mitre.org/detectionstrategies/DET012636author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)37date: 2026-08-1738tags:39  - attack.persistence40  - attack.privilege-escalation41  - attack.t1098.00442logsource:43  product: linux44  service: auditd45detection:46  selection:47    type: 'PATH'48    name|contains: 'authorized_keys'49  condition: selection50falsepositives:51  - "Configuration management enforcing SSH access. The Ansible authorized_key module, Puppet's ssh_authorized_key resource, Chef and Salt all rewrite the file on every run regardless of whether its contents changed, and agent-based runs are commonly on a 15 to 30 minute interval across the whole estate. On a managed fleet this is the highest-volume match by a wide margin, and it is the reason this rule is scored low rather than high."52  - "Cloud instance key provisioning. cloud-init, the AWS and GCP guest agents and the Azure Linux agent refresh the default user's authorized_keys from instance metadata at every boot and whenever the key is changed in the console, so an autoscaling group replacing nodes produces a steady stream of matches with no human involved."53  - "Administrators granting access by hand. ssh-copy-id run from a jump host appends to the file on the server side, and an administrator editing it with vim or nano produces PATH records for the file plus the editor's swap and backup copies, all of which the contains match picks up as separate hits for one edit."54  - "Backup and integrity-monitoring agents. If the auditd watch was loaded with read permission rather than -p wa, file-integrity tooling such as AIDE or Tripwire and any backup agent walking home directories will match this rule on every scheduled scan of every account on the host."55level: low