SSH Authorized Keys Modified for Backdoor Access

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to modify SSH authorized_keys files over a network connection, which could indicate an attacker establishing backdoor access. It specifically looks for the string "authorized_keys" within TCP traffic destined for port 22 (SSH).