T1098.004 — SSH Authorized Keys

Tactics: Persistence, Privilege Escalation · Platforms: ESXi, IaaS, Linux, macOS, Network Devices

Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The authorized_keys file in SSH specifies…

Sub-technique of Account Manipulation (T1098).

Sigma detection rules (5)

title: "T1098.004 Account Manipulation: SSH Authorized Keys"
id: 5277c705-17e3-4019-bc49-87b8a023678c
description: 'Detection Strategy for SSH Key Injection in Authorized Keys. (Retargeted to the file_change auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: TimeWindow, UserContext, TargetPath.'
references:
  - https://attack.mitre.org/techniques/T1098/004
author: Shahrukh Khan
date: 2026-03-22
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.004

logsource:
  category: file_change
  product: linux

detection:
  selection:
    type: PATH
    name|contains: 'authorized_keys'
    nametype: NORMAL

  condition: selection

falsepositives:
  - Legitimate key rotation and onboarding via ssh-copy-id or config-management (Ansible/Puppet) modifies authorized_keys routinely; correlate with the expected CM tool's parent process to suppress those.

level: high

title: "T1098.004 Account Manipulation: SSH Authorized Keys"
id: 16aba844-041a-4da6-b2fb-379a4d974f78
description: 'Detection Strategy for SSH Key Injection in Authorized Keys. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: ParentProcess, InteractiveSessionFlag.'
references:
  - https://attack.mitre.org/techniques/T1098/004
author: Shahrukh Khan
date: 2026-01-27
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.004

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    CommandLine|contains: '.ssh/authorized_keys'

  condition: selection

falsepositives:
  - Legitimate administrators or configuration management tools such as Ansible add authorized SSH keys the same way.

level: high

title: "T1098.004 Account Manipulation: SSH Authorized Keys"
id: fcee93f9-fb1b-4da8-a6e2-fb142e1eda6a
description: 'Detection Strategy for SSH Key Injection in Authorized Keys. (Data Component: File Modification; baseline tier: fallback.) Tune using: MetadataFieldName, AccountType, TargetRoleEscalation.'
references:
  - https://attack.mitre.org/techniques/T1098/004
author: Shahrukh Khan
date: 2026-06-06
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.004

logsource:
  category: file_change
  product: linux
  service: auditd

detection:
  selection:
    type: PATH
    nametype:
      - CREATE
      - NORMAL
    name|contains: '/.ssh/authorized_keys'

  condition: selection

falsepositives:
  - Legitimate SSH key provisioning by administrators, configuration management tools such as Ansible or Puppet, or cloud-init during instance bootstrap.

level: high

title: "T1098.004 Account Manipulation: SSH Authorized Keys"
id: bc2edde6-c104-4373-922a-86bf689abfe6
description: 'Detection Strategy for SSH Key Injection in Authorized Keys. Removed the standalone ssh-keygen selection, which fired on any keypair generation regardless of whether it was ever appended to an authorized_keys file - generating a keypair alone is not the persistence behavior this technique describes. Detection now requires the actual injection pattern: an echo (or similar) invocation containing an ssh-rsa/ssh-ed25519 key string targeting an authorized_keys path. (Data Component: Command Execution; baseline tier: fallback.) Tune using: CLIUserRole, DeviceModel.'
references:
  - https://attack.mitre.org/techniques/T1098/004
author: Shahrukh Khan
date: 2026-01-10
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.004

logsource:
  category: process_creation
  product: linux
  service: auditd

detection:
  selection_append:
    type: EXECVE
    a0|endswith: '/echo'
    a1|contains:
      - 'ssh-rsa'
      - 'ssh-ed25519'
  selection_target:
    type: EXECVE
    a2|contains: 'authorized_keys'

  condition: selection_append and selection_target

falsepositives:
  - Administrators or configuration management tools such as Ansible legitimately provisioning SSH access for new users or automation accounts.

level: high

title: "T1098.004 Account Manipulation: SSH Authorized Keys"
id: 0050f944-67d2-47aa-a720-36e4ce467668
description: 'Detection Strategy for SSH Key Injection in Authorized Keys. (Retargeted to the file_change ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SSHConfigPath, ESXiShellActivity.'
references:
  - https://attack.mitre.org/techniques/T1098/004
author: Shahrukh Khan
date: 2026-02-21
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.004

logsource:
  category: file_change
  product: esxi
  service: shell

detection:
  selection:
    CommandLine|contains: 'authorized_keys'
  selection_write:
    CommandLine|contains:
      - 'echo'
      - 'cat >>'

  condition: selection and selection_write

falsepositives:
  - Automated configuration management tools such as Host Profiles or Ansible that legitimately push SSH keys for authentication also modify this file.

level: high

Related sub-techniques

• T1098.002 Additional Email Delegate Permissions
• T1098.005 Device Registration
• T1098.001 Additional Cloud Credentials
• T1098.003 Additional Cloud Roles
• T1098.006 Additional Container Cluster Roles
• T1098.007 Additional Local or Domain Groups

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1098.004 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan