Techniques › T1098 › T1098.004
T1098.004 SSH Authorized Keys
persistence · privilege escalation — ESXi, IaaS, Linux, macOS, Network Devices · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
0
Sigma rules tagged attack.t1098.004
1
KEV CVEs mapped here
<p>Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The <code>authorized_keys</code> file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under <code><user-home>/.ssh/authorized_keys</code> (or, on ESXi,
/etc/ssh/keys-<username>/authorized_keys). Users may edit the system’s SSH config file to modify the directives PubkeyAuthentication and RSAAuthentication to the value yes to ensure public key and RSA authentication are enabled, as well as modify the directive PermitRootLogin to the value yes to enable root authentication via SSH. The SSH config file is usually located under <code>/etc/ssh/sshd_config</code>.</p><p>Adversaries may modify SSH <code>authorized_keys</code> files directly with scripts or shell commands to add their own adversary-supplied public keys. In cloud environments, adversaries may be able to modify the SSH authorized_keys file of a particular virtual machine via the command line interface or rest API. For example, by using the Google Cloud CLI’s “add-metadata” command an adversary may add SSH keys to a user account. Similarly, in Azure, an adversary may update the authorized_keys file of a virtual machine via a PATCH request to the API. This ensures that an adversary possessing the corresponding private key may log in as an existing user via SSH. It may also lead to privilege escalation where the virtual machine or instance has distinct permissions from the requesting user.</p><p>Where authorized_keys files are modified via cloud APIs or command line interfaces, an adversary may achieve privilege escalation on the target virtual machine if they add a key to a higher-privileged user.</p><p>SSH keys can also be added to accounts on network devices, such as with the ip ssh pubkey-chain Network Device CLI command.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2022-40684 | Fortinet Multiple Products | primary impact | Mapped | 2022-10-11 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0126 Detection Strategy for SSH Key Injection in Authorized Keys v1.0
AN0350 LinuxAdversary attempts to gain persistence by modifying ~/.ssh/authorized_keys via shell, text editor, echo or redirected output.Tunable:
TimeWindowUserContextTargetPathAN0351 macOSInsertion of public keys into authorized_keys using bash/zsh or editor tools, correlated with suspicious process ancestry.Tunable:ParentProcessInteractiveSessionFlagAN0352 IaaSAbuse of cloud metadata APIs or CLI to push SSH public keys to authorized_keys of virtual machines.Tunable:MetadataFieldNameAccountTypeTargetRoleEscalationAN0353 ESXiDirect modification of /etc/ssh/keys-<user>/authorized_keys or enabling SSH in sshd_config to support public key auth.Tunable:SSHConfigPathESXiShellActivityAN0354 Network DevicesUse of command-line likeip ssh pubkey-chainto bind SSH keys to privileged accounts on routers or switches.Tunable:CLIUserRoleDeviceModel
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1098.004
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content. 1 actively exploited CVE maps here.
Rules tagged at the parent level (attack.t1098) 34
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows category=ps_script · 02122374-b74e-495c-b285-9e4da973f3d6
Detects the creation of a dMSA service account using the New-ADServiceAccount cmdlet in certain OUs.
The fact that the cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.
It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,
it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
Author: Thomas Patzke
· 2019-12-03 (modified 2024-01-16) · logsource: product=windows service=security · 0255a820-e564-4e40-af2b-6ac61160335c
Addition of domains is seldom and should be verified for legitimacy.
Author: Alexandr Yampolskyi, SOC Prime
· 2023-04-26 · logsource: product=windows service=security · 02c39d30-02b5-45d2-b435-8aebfe5a8629
Detects activity when a member is removed from a security-enabled global group
Author: Austin Songer
· 2021-08-23 (modified 2023-10-11) · logsource: product=gcp service=google_workspace.admin · 04e2a23a-9b29-4a5c-be3a-3542e3f982ba
Detects when an API access service account is granted domain authority.
Author: toffeebr33k
· 2021-08-09 (modified 2024-04-26) · logsource: product=aws service=cloudtrail · 055fb148-60f8-462d-ad16-26926ce050f1
Detects activity when someone is changing passwords on behalf of other users.
An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.
Author: faloker
· 2020-02-12 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2
Detects AWS API key creation for a user by another user.
Backdoored users can be used to obtain persistence in the AWS environment.
Also with this alert, you can detect a flow of AWS keys in your org.
Author: Pawel Mazur
· 2022-12-21 (modified 2025-01-21) · logsource: product=linux · 0ac15ec3-d24f-4246-aa2a-3077bb1cf90e
Detects the addition of a new user to a privileged group such as "root" or "sudo"
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows category=process_creation · 0ea8db81-2ff6-4525-9448-33bbe7effc13
Detects the creation of a dMSASvc account using the New-ADServiceAccount cmdlet in certain OUs.
The fact that the Cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.
It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,
it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
· 2022-08-05 · logsource: product=azure service=auditlogs · 102e11e3-2db5-4c9e-bc26-357d42585d21
Detects when a user is removed from a privileged role. Bulk changes should be investigated.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2024-02-23 · logsource: product=windows category=process_creation · 10fb649c-3600-4d37-b1e6-56ea90bb7e09
Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · 258b6593-215d-4a26-a141-c8e31c1299a6
Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.
Author: Samir Bousseaden, Roberto Rodriguez @Cyb3rWard0g, oscd.community, Tim Shelton, Maxence Fossat
· 2019-04-03 (modified 2022-08-16) · logsource: product=windows service=security · 2c99737c-585d-4431-b61a-c911d86ff32f
Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer
Author: Austin Songer
· 2021-08-23 (modified 2023-10-11) · logsource: product=gcp service=google_workspace.admin · 2d1b83e4-17c6-4896-a37b-29140b40a788
Detects when an Google Workspace user is granted admin privileges.
Author: @neu5ron
· 2017-04-13 (modified 2024-02-26) · logsource: product=windows service=security · 300bac00-e041-4ee2-9c36-e262656a6ecc
Detects scenarios where one can control another users or computers account without having to use their credentials.
Author: @neu5ron
· 2017-07-30 (modified 2021-12-02) · logsource: product=windows service=security · 311b6ce2-7890-4383-a8c2-663a9f6b43cd
Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.
Author: Bryan Lim
· 2024-01-12 · logsource: product=gcp service=gcp.audit · 32438676-1dba-4ac7-bf69-b86cba995e05
Detects when an access policy that is applied to a GCP cloud resource is deleted.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
Author: Elastic, Austin Songer @austinsonger
· 2021-07-22 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 3940b5f1-3f46-44aa-b746-ebe615b879e0
Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.
Author: Florian Roth (Nextron Systems)
· 2021-12-22 (modified 2022-12-25) · logsource: product=windows service=security · 45eb2ae2-9aa2-4c3a-99a5-6e5077655466
Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287
Author: AlertIQ
· 2021-10-10 (modified 2022-12-25) · logsource: product=azure service=auditlogs · 4d78a000-ab52-4564-88a5-7ab5242b20c7
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
Author: frack113
· 2021-12-28 · logsource: product=windows category=ps_script · 4fdc44df-bfe9-4fcc-b041-68f5a2d3031c
Adversaries may manipulate accounts to maintain access to victim systems.
Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups
Author: Thomas Patzke
· 2017-02-19 (modified 2020-08-23) · logsource: product=windows service=security · 53ad8e36-f573-46bf-97e4-15ba5bf4bb51
Detects potential attempts made to set the Directory Services Restore Mode administrator password.
The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers.
Attackers may change the password in order to obtain persistence.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows service=security · 6c9eb492-e477-4df9-b0f4-571fc9db29cd
Detects modifications to the msDS-ManagedAccountPrecededByLink attribute, which may indicate an attempted or successful abuse of the BaD-Successor msDS-DelegatedManagedServiceAccount (DMSA) vulnerability.
The DMSA is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups.
Changes to this attribute by suspicious accounts or outside of normal administrative workflows are a strong signal of an attempted or successful abuse.
If it is indeed modified by an account that is not typically responsible for such changes, it could indicate an attempt to exploit the BaD-Successor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 6d844f0f-1c18-41af-8f19-33e7654edfc3
Find local accounts being created or modified as well as remote authentication configurations
Author: Daniel Koifman (KoifSec)
· 2025-07-30 · logsource: product=windows category=process_creation · 7864a175-3654-4824-9f0d-f0da18ab27c0
Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-09-04 · logsource: product=linux category=process_creation · 9691f58d-92c1-4416-8bf3-2edd753ec9cf
Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows category=ps_script · 9b111d8e-92e0-4153-88bc-daefc1333aba
Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts.
This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
Author: Muhammad Faisal (@faisalusuf)
· 2024-02-25 · logsource: product=bitbucket service=audit · aac6c4f4-87c7-4961-96ac-c3fd3a42c310
Detects global permissions change activity.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-08-12 (modified 2023-03-02) · logsource: product=windows category=process_creation · ad720b90-25ad-43ff-9b5e-5c841facc8e5
Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".
Author: Elastic, Austin Songer @austinsonger
· 2021-07-22 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · b056de1a-6e6e-4e40-a67e-97c9808cf41b
Detects when a request has been made to transfer a Route 53 domain to another AWS account.
Author: Alexandr Yampolskyi, SOC Prime
· 2023-04-26 · logsource: product=windows service=security · b237c54b-0f15-4612-a819-44b735e0de27
Detects activity when a security-enabled global group is deleted
Author: Florian Roth (Nextron Systems)
· 2017-03-14 (modified 2021-01-17) · logsource: product=windows service=security · c265cf08-3f99-46c1-8d59-328247057d57
Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity
Author: Alexandr Yampolskyi, SOC Prime
· 2023-04-26 · logsource: product=windows service=security · c43c26be-2e87-46c7-8661-284588c5a53e
Detects activity when a member is added to a security-enabled global group
Author: sawwinnnaung
· 2020-05-07 (modified 2023-10-11) · logsource: product=azure service=activitylogs · d2d901db-7a75-45a1-bc39-0cbf00812192
Number of VM creations or deployment activities occur in Azure via the azureactivity log.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows service=security · e15bc294-ae2a-45ad-b7d6-637b33868bde
Detects the creation of new msDS-DelegatedManagedServiceAccount objects, which could indicate potential abuse of privilege escalation vulnerabilities in Windows Server 2025.
The msDS-DelegatedManagedServiceAccount (DMSA) is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups.
Attackers may exploit this feature to create unauthorized service accounts with elevated privileges, leading to privilege escalation within the Active Directory environment.
It is highly suspicious if an msDS-DelegatedManagedServiceAccount object is created without proper authorization or in an unexpected context, such as by a non-administrative user or outside of normal administrative workflows.
So, it's a good idea to look out for accounts that are not typically responsible for service account creation to detect potential abuse of this feature.