Malicious SSH Key Persistence via authorized_keys
Detects the addition of a specific threat actor SSH key to an authorized_keys file for persistence. This key was used in a campaign involving a malicious Go crypto module that delivered the Rekoobe backdoor. The rule specifically looks for command-line activity that modifies the authorized_keys file and contains the hardcoded malicious SSH key, often initiated by shell processes.
Microsoft Sentinel (KQL)
