SSH authorized_keys File Modification for Persistence

Ibrahim Saud@tektrix

•updated Sep 28, 2026•2•0•7

Detects the creation or modification of SSH authorized_keys or authorized_keys2 files. This is a common persistence technique used to maintain remote access by adding an adversary-controlled public key to a user's configuration, often performed after initial access through exploitation of public-facing services.