MITRE ATT&CK  /  T1098.004

T1098.004

SSH Authorized Keys

Description

Adversaries may modify the SSH <code>authorized_keys</code> file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management. The <code>authorized_keys</code> file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured. This file is usually found in the user's home directory under <code><user-home>/.ssh/authorized_keys</code> (or, on ESXi, `/etc/ssh/keys-<username>/authorized_keys`).(Citation: SSH Authorized Keys) Users may edit the system’s SSH config file to modify the directives `PubkeyAuthentication` and `RSAAuthentication` to the value `yes` to ensure public key and RSA authentication are enabled, as well as modify the directive `PermitRootLogin` to the value `yes` to enable root authentication via SSH.(Citation: Broadcom ESXi SSH) The SSH config file is usually located under <code>/etc/ssh/sshd_config</code>.Adversaries may modify SSH <code>authorized_keys</code> files directly with scripts or shell commands to add their own adversary-supplied public keys. In cloud environments, adversaries may be able to modify the SSH authorized_keys file of a particular virtual machine via the command line interface or rest API. For example, by using the Google Cloud CLI’s “add-metadata” command an adversary may add SSH keys to a user account.(Citation: Google Cloud Add Metada…

Platforms

Mitigations

• M1018 — User Account Management
• M1022 — Restrict File and Directory Permissions
• M1042 — Disable or Remove Feature or Program

Our coverage

• Dirty Frag: CVE-2026-43284 and CVE-2026-43500 Grant Root Access Across All Major Linux Distros
• PRC State-Sponsored Telecom Router Compromise Detection: CISA AA25-239a Breakdown
• Ruby Gem Supply Chain Attack Detection: CI Checklist for Sleeper Packages
• DPRK npm Malware Detection: Auditing npm for AI-Generated Backdoors
• cPanel CVE-2026-41940 Was Actively Exploited for 30 Days Before Patch

Source: MITRE ATT&CK Enterprise matrix. View on attack.mitre.org →