Sub-technique of T1098 Account Manipulation.View on attack.mitre.org
Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The authorized_keys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under <user-home>/.ssh/authorized_keys (or, on ESXi, `/etc/ssh/keys-<username>/authorized_keys`). Users may edit the system’s SSH config file to modify the directives `PubkeyAuthentication` and `RSAAuthentication` to the value `yes` to ensure public key and RSA authentication are enabled, as well as modify the directive `PermitRootLogin` to the value `yes` to enable root authentication via SSH. The SSH config file is usually located under /etc/ssh/sshd_config.
Adversaries may modify SSH authorized_keys files directly with scripts or shell commands to add their own adversary-supplied public keys. In cloud environments, adversaries may be able to modify the SSH authorized_keys file of a particular virtual machine via the command line interface or rest API. For example, by using the Google Cloud CLI’s “add-metadata” command an adversary may add SSH keys to a user account. Similarly, in Azure, an adversary may update the authorized_keys file of a virtual machine via a PATCH request to the API. This ensures that an adversary possessing the corresponding private key may log in as an existing user via SSH. It may also lead to privilege escalation where the virtual machine or instance has distinct permissions from the requesting user.
Where authorized_keys files are modified via cloud APIs or command line interfaces, an adversary may achieve privilege escalation on the target virtual machine if they add a key to a higher-privileged user.
SSH keys can also be added to accounts on network devices, such as with the `ip ssh pubkey-chain` Network Device CLI command.
Rules on DetectionCode tagged with T1098.004.
| Rule | Type | Risk | Data source |
|---|---|---|---|
| Linux Auditd Possible Access Or Modification Of Sshd Config File | Anomaly | NULL | Linux Auditd Path, Linux Auditd Cwd |
| Linux Possible Access Or Modification Of sshd Config File | Anomaly | NULL | Sysmon for Linux EventID 1 |
| Linux Possible Ssh Key File Creation | Anomaly | NULL | Sysmon for Linux EventID 11 |
| Linux SSH Authorized Keys Modification | Anomaly | NULL | Sysmon for Linux EventID 1 |
| Used by | Procedure example |
|---|---|
| GroupEarth Lusca | Earth Lusca has dropped an SSH-authorized key in the `/root/.ssh` folder in order to access a compromised server with SSH. |
| GroupSalt Typhoon | Salt Typhoon has added SSH authorized_keys under root or other users at the Linux level on compromised network devices. |
| GroupTeamTNT | TeamTNT has added RSA keys in |
| Used by | Procedure example |
|---|---|
| MalwareBundlore | Bundlore creates a new key pair with |
| MalwareSkidmap | Skidmap has the ability to add the public key of its handlers to the |
| MalwareXCSSET | XCSSET will create an ssh key if necessary with the |
| Used by | Procedure example |
|---|---|
| CampaignOperation Digital Eye | During Operation Digital Eye, threat actors used SSH access enabled by authorized_keys files for remote execution. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
