EtherRAT SSH Backdoor Installation and Persistence
Detection of EtherRAT's SSH backdoor module that appends attacker-controlled public keys to authorized_keys. The rule correlates the creation of the .ssh directory with key injection and permission setting. It also identifies direct writes or appends to authorized_keys, and specific chmod operations on authorized_keys. Additionally, it looks for Node.js processes writing or appending to authorized_keys, indicating potential automated key injection.
Sigma
