SSH Key Added to Server via Web Shell

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects attempts to add an SSH key to a server's authorized_keys file via a web shell. It specifically looks for HTTP POST requests where the URI content includes "authorized_keys". This activity is indicative of an attacker establishing persistence on a compromised server by adding their SSH key for future unauthorized access.