Ssh Directory Reset Key Based Persistence
Detects an attacker preparing a Linux host for SSH key-based persistence. The behavior chain is: (1) clearing the immutable and append-only attributes on the .ssh directory using chattr -ia, (2) deleting the .ssh directory with rm -rf, and then planting a new attacker-controlled public key in authorized_keys. Clearing the attributes removes protections that would otherwise block modification or deletion, even by root, and gives the attacker a clean slate to install their own key and often re-lock it with chattr +ia. This sequence was observed in honeypot data and is commonly associated with automated SSH botnet and cryptominer campaigns. False positi
YARA
