tfMITRE ATT&CK sub-technique

SSH Authorized Keys T1098.004

sub-technique of T1098 Account Manipulation

Tactics: Persistence, Privilege Escalation
Platforms: ESXi, IaaS, Linux, macOS, Network Devices
Version: 1.4
Created: 24 June 2020
Last modified: 12 May 2026
Contributors: Tony Lambert, Red Canary; Dror Alon, Palo Alto Networks; Or Kliger, Palo Alto Networks; Austin Clark, @c2defense; Arad Inbar, Fidelis Security

Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The authorized_keys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under <user-home>/.ssh/authorized_keys (or, on ESXi, /etc/ssh/keys-<username>/authorized_keys).[1] Users may edit the system’s SSH config file to modify the directives PubkeyAuthentication and RSAAuthentication to the value yes to ensure public key and RSA authentication are enabled, as well as modify the directive PermitRootLogin to the value yes to enable root authentication via SSH.[2] The SSH config file is usually located under /etc/ssh/sshd_config.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups64th pct

Threat groups64th percentile · 64% of ATT&CK techniques have this many threat groups attributed or fewer.

Campaigns72nd pct

Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.

Tools & malware57th pct

Tools & malware57th percentile · 57% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

SSH Authorized Keys MITRE reference T1098.004

64th pctamong all ATT&CK techniques for number of groups

3 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

Salt TyphoonG1045 ↗

Has added SSH authorized_keys under root or other users at the Linux level on compromised network devices.1

created 2025-02-241 reference

Earth LuscaG1006 ↗

Has dropped an SSH-authorized key in the /root/.ssh folder in order to access a compromised server with SSH.1

created 2022-07-011 referenceaka TAG-22

TeamTNTG0139 ↗

Has added RSA keys in authorized_keys.1 2

created 2021-10-012 references

All 3 groups for this technique

3 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

XCSSETS0658 ↗

Will create an ssh key if necessary with the ssh-keygen -t rsa -f $HOME/.ssh/id_rsa -P command. XCSSET will upload a private key file to the server to remotely access the host without a password.1

created 2021-10-05MALWARE

BundloreS0482 ↗

Creates a new key pair with ssh-keygen and drops the newly created user key in authorized_keys to enable remote login.1

created 2020-07-01MALWARE

SkidmapS0468 ↗

Has the ability to add the public key of its handlers to the authorized_keys file to maintain persistence on an infected host.1

created 2020-06-09MALWARE

All 3 software entries for this technique

Offense vs defense T1098.004

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 1Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 4

first rule: 2022 Q1 · 1 of 1 campaigns plotted

SSH Authorized Keys detection strategy DET0126

MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for SSH Key Injection in Authorized Keys

Enterprise

5 platforms

AN0350 · Linux

Adversary attempts to gain persistence by modifying ~/.ssh/authorized_keys via shell, text editor, echo or redirected output.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	auditd:SYSCALL	execve
File ModificationDC0061	auditd:SYSCALL	write \| PATH=/home/*/.ssh/authorized_keys

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
TimeWindow	Temporal window to correlate file writes and suspicious process launches (e.g., <60s)
UserContext	Expected user-to-process correlation (e.g., root writing to non-root authorized_keys)
TargetPath	Custom SSH path or user home variation (e.g., /etc/skel/.ssh/)

AN0351 · macOS

Insertion of public keys into authorized_keys using bash/zsh or editor tools, correlated with suspicious process ancestry.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	process: exec + filewrite: ~/.ssh/authorized_keys
File ModificationDC0061	macos:auth	~/.ssh/authorized_keys

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ParentProcess	Track unusual parent process writing to SSH config (e.g., curl -> bash)
InteractiveSessionFlag	Flag whether shell session was interactive (normal) or spawned remotely (potential abuse)

AN0352 · IaaS

Abuse of cloud metadata APIs or CLI to push SSH public keys to authorized_keys of virtual machines.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File ModificationDC0061	gcp:audit	compute.instances.setMetadata

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MetadataFieldName	Custom metadata field (e.g., ssh-keys or custom-key)
AccountType	Was it an admin, service principal, or automation user initiating?
TargetRoleEscalation	Privilege level of the VM account receiving the key

AN0353 · ESXi

Direct modification of /etc/ssh/keys-<user>/authorized_keys or enabling SSH in sshd_config to support public key auth.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File ModificationDC0061	esxi:shell	file write or edit

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
SSHConfigPath	Could be modified SSH path in hypervisor
ESXiShellActivity	Whether shell was enabled beforehand via DCUI or API

AN0354 · Network Devices

Use of command-line like ip ssh pubkey-chain to bind SSH keys to privileged accounts on routers or switches.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Command ExecutionDC0064	networkdevice:cli	ip ssh pubkey-chain

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CLIUserRole	Was the role allowed to push persistent config changes?
DeviceModel	Variations in syntax or log behavior across device OS

Disable or Remove Feature or ProgramM1042

Disable SSH if it is not necessary on a host or restrict SSH access for specific users/groups using /etc/ssh/sshd_config. Setting the PermitRootLogin directive to no will prevent the root user from logging in via SSH.

Restrict File and Directory PermissionsM1022

Restrict access to the authorized_keys file.

User Account ManagementM1018

In cloud environments, ensure that only users who explicitly require the permissions to update instance metadata or configurations can do so.

Tests1Executorssh 1Need elevation0 of 1Have prerequisites0Have cleanup1Platformslinux, macos

#	Test	Platform	Executor	Elevation	Prereqs	Cleanup	Ref
01	Modify SSH Authorized Keys	linux, macos	sh	—	—	Yes
Modify contents of <user-home>/.ssh/authorized_keys to maintain persistence on victim host. If the user is able to save the same contents in the authorized_keys file, it shows user can modify the file. Attack command if [ -f ~/.ssh/authorized_keys ]; then ssh_authorized_keys=$(cat ~/.ssh/authorized_keys); echo "$ssh_authorized_keys" > ~/.ssh/authorized_keys; fi; Cleanup command unset ssh_authorized_keys GUID41093d9e-6af9-4dcb-a12d-9ac841e3a688

Tests from Atomic Red Team (MIT licence) · technique definition

SSH Authorized Keys detections T1098.004

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs