SSH Private Key Access by dlp.sh/Terraform Provisioner Scripts

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•1

This rule detects potentially unauthorized access or attempts to copy sensitive SSH keys (e.g., id_rsa, id_ed25519) by command-line utilities (such as cat, cp, tar, scp, or curl) or when triggered by automation-related process names like 'terraform'. It monitors both process command lines and file events to identify staging or exfiltration activities.