BIOC
Informational
✕
Reading .ssh files
Attackers may gather SSH keys (typically found in the ~/.ssh/ directory) to later use to authenticate with remote SSH servers.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Credential Access
- Status:
- Enabled
ATT&CK tactics: Credential Access (TA0006)
ATT&CK techniques: Unsecured Credentials: Private Keys (T1552.004)
Indicator:
Process action type = execution AND target process cmd = * .ssh , * .ssh * , * .ssh/* , */.ssh * , */.ssh/* AND target process name = cat , grep AND target process cmd != *grep -c* Process initiated by != ssh-copy-id AND rkhunter AND cgo name != nessus-service AND sshd AND electron AND sshd-keygen-wrapper AND ir_agent AND bbedit
Preventable: yes