Most Popular Detection 2026: SSH authorized_keys Tampering for Persistence
Detects unauthorized modifications to the .ssh/authorized_keys file. Such changes are often performed by adversaries to establish persistence by ensuring their own public keys allow them remote access to the host. The rule filters out known configuration management and system tools to reduce noise.
Microsoft Sentinel (KQL)
