← Library
kqlElastic-2.0from elastic/detection-rules

Successful SSH Authentication from Unusual SSH Public Key

Quality
92
FP risk
—
Forks
0
Views
0
ATT&CK techniques
T1078T1133T1021T1021.004
Rule sourcerules/linux/initial_access_first_time_public_key_authentication.toml
event.category:authentication and host.os.type:linux and event.action:ssh_login and event.outcome:success and system.auth.ssh.method:publickey