T1098.004: SSH Authorized Keys

Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host. Linux distributions and macOS commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The authorized_keys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under \. Users may edit the system’s SSH config file to modify the directives PubkeyAuthentication and RSAAuthentication to the value “yes” to ensure public key and RSA authentication are enabled. The SSH config file is usually located under /etc/ssh/sshd_config.


Adversaries may modify SSH authorized_keys files directly with scripts or shell commands to add their own adversary-supplied public keys. In cloud environments, adversaries may be able to modify the SSH authorized_keys file of a particular virtual machine via the command line interface or rest API. For example, by using the Google Cloud CLI’s “add-metadata” command an adversary may add SSH keys to a user account. Similarly, in Azure, an adversary may update the authorized_keys file of a virtual machine via a PATCH request to the API. This ensures that an adversary possessing the corresponding private key may log in as an existing user via SSH. It may also lead to privilege escalation where the virtual machine or instance has distinct permissions from the requesting user.
Where authorized_keys files are modified via cloud APIs or command line interfaces, an adversary may achieve privilege escalation on the target virtual machine if they add a key to a higher-privileged user. 
SSH keys can also be added to accounts on network devices, such as with the ip ssh pubkey-chain Network Device CLI command.

Positive Technologies products that cover the technique

MaxPatrol SIEM knowledge base

unix_mitre_attck_persistence: PT-CR-447: Unix_SSH_Key_Modify: User SSH key files were changed

Detection

ID	DS0017	Data source and component	Command: Command Execution	Description	Monitor executed commands and arguments to modify the authorized_keys or /etc/ssh/sshd_config files.

ID	DS0009	Data source and component	Process: Process Creation	Description	Monitor for suspicious processes modifying the authorized_keys or /etc/ssh/sshd_config files.

ID	DS0022	Data source and component	File: File Modification	Description	Monitor for changes made to detect changes made to the authorized_keys file for each user on a system. Monitor for changes to and suspicious processes modifiying /etc/ssh/sshd_config.

ID	Data source and component	Description
DS0017	Command: Command Execution	Monitor executed commands and arguments to modify the authorized_keys or /etc/ssh/sshd_config files.
DS0009	Process: Process Creation	Monitor for suspicious processes modifying the authorized_keys or /etc/ssh/sshd_config files.
DS0022	File: File Modification	Monitor for changes made to detect changes made to the authorized_keys file for each user on a system. Monitor for changes to and suspicious processes modifiying /etc/ssh/sshd_config.

Mitigation

ID	M1022	Name	Restrict File and Directory Permissions	Description	Restrict access to the `authorized_keys` file.

ID	M1018	Name	User Account Management	Description	In cloud environments, ensure that only users who explicitly require the permissions to update instance metadata or configurations can do so.

ID	M1042	Name	Disable or Remove Feature or Program	Description	Disable SSH if it is not necessary on a host or restrict SSH access for specific users/groups using `/etc/ssh/sshd_config`.

ID	Name	Description
M1022	Restrict File and Directory Permissions	Restrict access to the `authorized_keys` file.
M1018	User Account Management	In cloud environments, ensure that only users who explicitly require the permissions to update instance metadata or configurations can do so.
M1042	Disable or Remove Feature or Program	Disable SSH if it is not necessary on a host or restrict SSH access for specific users/groups using `/etc/ssh/sshd_config`.