Process reads a private key file under a user's SSH or GPG directory

Siemphony@siemphonylowT1552.004unverifiedPlaybook · Credential theft

Matches AN1517's Linux observable directly off MITRE's own CommandLineMatch examples — `cat ~/.ssh/id_rsa`, `tar ~/.gnupg` — by requiring a file-handling tool together with a path fragment naming a private-key file or directory on the same command line. The tool list covers reading, copying and archiving (cat, less, cp, scp, rsync, tar, gpg, base64) rather than every possible binary, since an unbounded tool list would match almost any process that happens to take a path argument. AN1517's second observable — the read followed by unusual shell activity or a network connection — is a correlation over MITRE's TimeWindow knob that this single process_creation event cannot express, so a hit here is access to the file, not confirmed exfiltration. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0549, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Process reads a private key file under a user's SSH or GPG directory2id: 30d6c544-2f2d-43cd-9887-1c8944af72603status: experimental4description: |5  Matches AN1517's Linux observable directly off MITRE's own CommandLineMatch6  examples — `cat ~/.ssh/id_rsa`, `tar ~/.gnupg` — by requiring a file-handling7  tool together with a path fragment naming a private-key file or directory on8  the same command line. The tool list covers reading, copying and archiving9  (cat, less, cp, scp, rsync, tar, gpg, base64) rather than every possible10  binary, since an unbounded tool list would match almost any process that11  happens to take a path argument. AN1517's second observable — the read12  followed by unusual shell activity or a network connection — is a correlation13  over MITRE's TimeWindow knob that this single process_creation event cannot14  express, so a hit here is access to the file, not confirmed exfiltration.15  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0549, not hand-written and not tested by its author. Any lab result is on this rule's own page.16references:17  - https://attack.mitre.org/techniques/T1552/00418  - https://attack.mitre.org/detectionstrategies/DET054919author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)20date: 2026-08-1621tags:22  - attack.credential-access23  - attack.t1552.00424logsource:25  category: process_creation26  product: linux27detection:28  selection_tool:29    Image|endswith:30      - '/cat'31      - '/less'32      - '/more'33      - '/cp'34      - '/scp'35      - '/rsync'36      - '/tar'37      - '/gpg'38      - '/gpg2'39      - '/base64'40  selection_keypath:41    CommandLine|contains:42      - '.ssh/id_rsa'43      - '.ssh/id_dsa'44      - '.ssh/id_ecdsa'45      - '.ssh/id_ed25519'46      - '.gnupg'47      - '.pem'48      - '.ppk'49      - '.p12'50      - '.pfx'51  condition: selection_tool and selection_keypath52falsepositives:53  - "Users or scripts reading their own id_rsa.pub public key to copy it into a remote authorized_keys file — the public key's path contains the same 'id_rsa' substring as the private key, so this selector cannot tell the two apart, and this is the highest-volume match by a wide margin on any host where admins manage SSH access by hand."54  - "Configuration-management and provisioning tooling (Ansible, Chef, Puppet) or backup jobs that use scp, rsync or tar to deploy or archive a user's ~/.ssh directory during account setup, host migration or routine backup — the exact tools and paths selected here are also the standard way to do this legitimately."55  - "Certificate-renewal automation (certbot and similar) or config-management pushing a rotated .pem or .pfx certificate to a web server, read or copied by cp or tar as part of the normal renewal hook."56level: low

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "/cat" or FolderPath endswith "/less" or FolderPath endswith "/more" or FolderPath endswith "/cp" or FolderPath endswith "/scp" or FolderPath endswith "/rsync" or FolderPath endswith "/tar" or FolderPath endswith "/gpg" or FolderPath endswith "/gpg2" or FolderPath endswith "/base64") and (ProcessCommandLine contains ".ssh/id_rsa" or ProcessCommandLine contains ".ssh/id_dsa" or ProcessCommandLine contains ".ssh/id_ecdsa" or ProcessCommandLine contains ".ssh/id_ed25519" or ProcessCommandLine contains ".gnupg" or ProcessCommandLine contains ".pem" or ProcessCommandLine contains ".ppk" or ProcessCommandLine contains ".p12" or ProcessCommandLine contains ".pfx"))

Splunk · SPL

Run this as a search.

index=* ((Image="*/cat" OR Image="*/less" OR Image="*/more" OR Image="*/cp" OR Image="*/scp" OR Image="*/rsync" OR Image="*/tar" OR Image="*/gpg" OR Image="*/gpg2" OR Image="*/base64") AND (CommandLine="*.ssh/id_rsa*" OR CommandLine="*.ssh/id_dsa*" OR CommandLine="*.ssh/id_ecdsa*" OR CommandLine="*.ssh/id_ed25519*" OR CommandLine="*.gnupg*" OR CommandLine="*.pem*" OR CommandLine="*.ppk*" OR CommandLine="*.p12*" OR CommandLine="*.pfx*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*/cat" OR TO_LOWER(process.executable) LIKE "*/less" OR TO_LOWER(process.executable) LIKE "*/more" OR TO_LOWER(process.executable) LIKE "*/cp" OR TO_LOWER(process.executable) LIKE "*/scp" OR TO_LOWER(process.executable) LIKE "*/rsync" OR TO_LOWER(process.executable) LIKE "*/tar" OR TO_LOWER(process.executable) LIKE "*/gpg" OR TO_LOWER(process.executable) LIKE "*/gpg2" OR TO_LOWER(process.executable) LIKE "*/base64") AND (TO_LOWER(process.command_line) LIKE "*.ssh/id_rsa*" OR TO_LOWER(process.command_line) LIKE "*.ssh/id_dsa*" OR TO_LOWER(process.command_line) LIKE "*.ssh/id_ecdsa*" OR TO_LOWER(process.command_line) LIKE "*.ssh/id_ed25519*" OR TO_LOWER(process.command_line) LIKE "*.gnupg*" OR TO_LOWER(process.command_line) LIKE "*.pem*" OR TO_LOWER(process.command_line) LIKE "*.ppk*" OR TO_LOWER(process.command_line) LIKE "*.p12*" OR TO_LOWER(process.command_line) LIKE "*.pfx*"))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(/cat$|/less$|/more$|/cp$|/scp$|/rsync$|/tar$|/gpg$|/gpg2$|/base64$)</field>    <field name="CommandLine" type="pcre2">(?i)(\.ssh/id_rsa|\.ssh/id_dsa|\.ssh/id_ecdsa|\.ssh/id_ed25519|\.gnupg|\.pem|\.ppk|\.p12|\.pfx)</field>    <description>Process reads a private key file under a user's SSH or GPG directory</description>    <mitre>      <id>T1552.004</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: low
Category: credential_dump
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 30d6c544-2f2d-43cd-9887-1c8944af7260

ATT&CKT1552.004

T1552.004Private Keys

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1552.004, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Review's sharpest finding is what's absent from selection_tool: openssl, the standard tool for exactly the .pem/.p12/.pfx types already in selection_keypath (openssl rsa -in ~/.ssh/id_rsa -text), isn't listed, despite gpg — a comparable crypto CLI — being included. That's a direct evasion path: openssl rsa -in ~/.ssh/id_rsa -text -noout, or any Python/Perl one-liner opening the key path via an unlisted interpreter, skips selection_tool entirely. Add openssl at minimum; consider head/tail/strings/xxd/vim/python if visibility into inspection, not just movement, matters. Downstream, correlate hits against real network egress or archive creation in the following minutes to approximate MITRE's TimeWindow knob and separate exfiltration from routine key management.

Declared by the author

Users or scripts reading their own id_rsa.pub public key to copy it into a remote authorized_keys file — the public key's path contains the same 'id_rsa' substring as the private key, so this selector cannot tell the two apart, and this is the highest-volume match by a wide margin on any host where admins manage SSH access by hand.
Configuration-management and provisioning tooling (Ansible, Chef, Puppet) or backup jobs that use scp, rsync or tar to deploy or archive a user's ~/.ssh directory during account setup, host migration or routine backup — the exact tools and paths selected here are also the standard way to do this legitimately.
Certificate-renewal automation (certbot and similar) or config-management pushing a rotated .pem or .pfx certificate to a web server, read or copied by cp or tar as part of the normal renewal hook.

Lessoncredential dump

credential dumpAI draft — unreviewed

01 · What this rule detects

AN1517 describes two joined observables: user- or script-based access to ~/.ssh or similar, followed by unusual shell activity or a network connection. This rule implements only the first half — a single process_creation event where a known file-handling tool runs with a private key path on its command line. It also covers only the Linux leg of DET0549; the strategy's Windows (AN1516) and macOS (AN1518) analytics need separate rules against entirely different logsources. A hit here means "file access," not "confirmed exfiltration" — the "followed by…" half lives in MITRE's TimeWindow knob, which a bare process_creation event can't express.

02 · Telemetry you need

category: process_creation, product: linux — Image and CommandLine from whatever agent shells out to auditd's EXECVE record (per AN1517's mutable elements) or an EDR agent with equivalent process telemetry. All four translations.json backends render this cleanly with nothing refused: Sentinel maps to DeviceProcessEvents (its generic process table, not an auditd-specific one), Splunk and Elastic do straightforward string matching, and Wazuh compiles Image/CommandLine into two pcre2 field checks. Because this depends on full command-line capture, an auditd config that logs syscall args without expanding shell built-ins, or any pipeline that truncates CommandLine, will silently under-collect rather than error.

03 · How the logic works

Two ANDed selections. selection_tool matches Image|endswith against nine binaries: cat, less, more, cp, scp, rsync, tar, gpg, gpg2, base64. Only cat and tar come straight from MITRE's own CommandLineMatch examples (cat ~/.ssh/id_rsa, tar ~/.gnupg); the other seven are the rule author's additions for read/copy/archive use cases MITRE didn't spell out. selection_keypath matches CommandLine|contains against the SSH key-name family (id_rsa, id_dsa, id_ecdsa, id_ed25519), .gnupg, and four certificate extensions (.pem, .ppk, .p12, .pfx) — populating MITRE's FilePathRegex knob, whose own description also names a bare *.key extension this list omits. contains rather than endswith is used throughout because the key path can sit anywhere inside a longer command line, behind flags or other arguments.

04 · Common false positives

The rule's own falsepositives are explicit and correctly ranked: the id_rsa substring also matches id_rsa.pub, so an admin running cat ~/.ssh/id_rsa.pub to hand a public key to a remote host is "the highest-volume match by a wide margin" — this is why the rule sits at level: low. Config-management tooling (Ansible, Chef, Puppet) and backup jobs using scp/rsync/tar against ~/.ssh during provisioning or migration are the second-largest source, and certbot-style renewal hooks touching .pem/.pfx are a third. Review adds a related but undisclosed gap: .pem, .p12, and .pfx paths equally match public certificates and chains, not just private keys — the same conflation as id_rsa.pub, extended to more extensions without its own falsepositives entry.

05 · Detection maturity

tier_1: . Machine-derived from MITRE's DET0549 scaffold, never run against real logs. Review calls it "the best-calibrated rule in this batch" — its level and its three named false positives are internally consistent with what the selectors will actually match — but that's a static-review judgment about self-consistency, not a measured hit rate. No detection or noise numbers exist until this runs read-only against real Linux process telemetry.

Related detections3 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/30d6c544-2f2d-43cd-9887-1c8944af7260

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Process reads a private key file under a user's SSH or GPG directory

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it