SSH Authorized Keys File Modification

Danny Y@zendannyy

•updated Apr 22, 2026•1•0•135

This rule detects attempts to modify the SSH authorized_keys file, which can be used by adversaries to maintain persistence on a compromised system, using common utilities like echo, tee, cp, mv, python, or perl.