SSH Authorized Keys Modified
A command writes to or locks an authorized_keys file. The attacker adds their own public key so they can come back without the password that let them in, often followed by chattr +i so the key can't be removed.
Tested
Matches all 3 attack events in match.jsonl and none of the 3 look-alike events in nomatch.jsonl. See the test events.
False positives
- Administrators adding keys by hand (verify against change records)
Sigma
title: SSH Authorized Keys Modified
id: 7e15ebb1-6111-4e6c-851b-4f6d36099f0b
status: experimental
description: |
A command writes to or locks an authorized_keys file. The attacker adds their own public key so they
can come back without the password that let them in, often followed by chattr +i so the key can't
be removed.
references:
- https://attack.mitre.org/techniques/T1098/004/
author: Estul Lachin
date: 2026-11-08
tags:
- attack.persistence
- attack.t1098.004
logsource:
product: cowrie
detection:
selection:
eventid: cowrie.command.input
input|contains: authorized_keys
write:
input|re: '>>?|\b(tee|cp|mv|chattr|sed\s+-i)\b'
condition: selection and write
falsepositives:
- Administrators adding keys by hand (verify against change records)
level: highSplunk SPL
``` SSH Authorized Keys Modified. Generated from rules/ssh_authorized_keys_persistence.yml by tools/build.py; do not edit. ```
index=honeypot sourcetype=cowrie:json eventid="cowrie.command.input" input="*authorized_keys*"
| regex input=">>?|\\b(tee|cp|mv|chattr|sed\\s+-i)\\b"Microsoft Sentinel KQL
// SSH Authorized Keys Modified. Generated from rules/ssh_authorized_keys_persistence.yml by tools/build.py; do not edit.
Cowrie_CL
| where (eventid =~ "cowrie.command.input" and input contains "authorized_keys") and input matches regex ">>?|\\b(tee|cp|mv|chattr|sed\\s+-i)\\b"