T1098.004sub-technique of T1098 Account Manipulation
SSH Authorized Keys
ESXi · IaaS · Linux · macOS · Network Devices1 piece on this siteT1098.004 on attack.mitre.org
Adversaries may modify the SSH `authorized_keys` file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The `authorized_keys` file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
Read
Analyses, case studies, guides, references and interview questions.
linux-triage.sh: a read-only first-hour collection script for Linux
One Bash file that collects processes, sockets, deleted-but-running binaries, logons, SSH keys, persistence and recent changes in order of volatility, using only what ships with a distribution. It writes text files and a SHA-256 manifest, and it is short enough to read before you run it.
how MITRE says to see it
Detection Strategy for SSH Key Injection in Authorized Keys
- Adversary attempts to gain persistence by modifying ~/.ssh/authorized_keys via shell, text editor, echo or redirected output.
- Insertion of public keys into authorized_keys using bash/zsh or editor tools, correlated with suspicious process ancestry.
- Abuse of cloud metadata APIs or CLI to push SSH public keys to authorized_keys of virtual machines.
- Direct modification of /etc/ssh/keys-<user>/authorized_keys or enabling SSH in sshd_config to support public key auth.
what reduces it
- M1018 User Account Management. In cloud environments, ensure that only users who explicitly require the permissions to update instance metadata or configurations can do so.
- M1022 Restrict File and Directory Permissions. Restrict access to the `authorized_keys` file.
- M1042 Disable or Remove Feature or Program. Disable SSH if it is not necessary on a host or restrict SSH access for specific users/groups using `/etc/ssh/sshd_config`. Setting the `PermitRootLogin` directive to `no` will prevent the root user from logging in via SSH.