Linux Possible Access Or Modification Of sshd Config File

The analytic detects suspicious access or modification of the sshd_config file on Linux systems. It focuses on command-line executions involving processes like "cat," "nano," "vim," and "vi" accessing the sshd_config file. Unauthorized changes to sshd_config can allow threat actors to redirect port connections or use unauthorized keys, potentially compromising the system, leading to unauthorized access, privilege escalation, or persistent backdoor access.