Unauthorized Modification of SSH Authorized Keys

Ankit Mehta@Secvyn

•updated Jun 24, 2026•0•0•3

This rule detects the creation, modification, or renaming of the `authorized_keys` file within the `.ssh` directory by processes other than common SSH key management or shell utilities. This activity could indicate an adversary attempting to establish persistence or elevate privileges by adding their own public key for SSH access.