SSH Authorized Keys
Subtechnique · ATTACK:enterprise:T1098.004
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1098.004",
"title": "SSH Authorized Keys",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1098/004",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--6b57dc31-b814-4a03-8706-28bc20d739c4",
"external_id": "T1098.004",
"domain": "enterprise",
"created": "2020-06-24T12:42:35.144Z",
"modified": "2026-05-12T15:12:00.640Z",
"version": "1.4",
"aliases": [
],
"tactics": [
"persistence",
"privilege-escalation"
],
"source_references": [
{
"source_name": "Venafi SSH Key Abuse",
"url": "https://www.venafi.com/blog/growing-abuse-ssh-keys-commodity-malware-campaigns-now-equipped-ssh-capabilities"
},
{
"source_name": "Broadcom ESXi SSH",
"url": "https://knowledge.broadcom.com/external/article/313767/allowing-ssh-access-to-vmware-vsphere-es.html"
},
{
"source_name": "Google Cloud Privilege Escalation",
"url": "https://about.gitlab.com/blog/2020/02/12/plundering-gcp-escalating-privileges-in-google-cloud-platform/"
},
{
"source_name": "cisco_ip_ssh_pubkey_ch_cmd",
"url": "https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/d1/sec-d1-cr-book/sec-cr-i3.html#wp1254331478"
},
{
"source_name": "Cybereason Linux Exim Worm",
"url": "https://www.cybereason.com/blog/new-pervasive-worm-exploiting-linux-exim-server-vulnerability"
},
{
"source_name": "Google Cloud Add Metadata",
"url": "https://cloud.google.com/sdk/gcloud/reference/compute/instances/add-metadata"
},
{
"source_name": "Azure Update Virtual Machines",
"url": "https://docs.microsoft.com/en-us/rest/api/compute/virtual-machines/update"
},
{
"source_name": "SSH Authorized Keys",
"url": "https://www.ssh.com/ssh/authorized_keys/"
}
]
}Explicit source assertions (12)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1006 → uses → ATTACK:enterprise:T1098.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1307fdab-a09c-4d48-a917-a76ba0113098
TrendMicro EarthLusca 2022ATTACK:enterprise:S0468 → uses → ATTACK:enterprise:T1098.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--13d595d2-9497-4bbe-be74-6e2a3a4dde06
Trend Micro SkidmapATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1098.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a545340-d4cf-40f1-a3e0-87ecdb957886
ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1098.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3bc431bd-f093-4daf-b264-e73f1fcf591a
ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1098.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--53113c1f-0cfd-453b-9044-d1da328f09c4
CISA_AA25-239ASaltTyphoon_Sept2025 · Cisco Salt Typhoon FEB 2025ATTACK:enterprise:S0658 → uses → ATTACK:enterprise:T1098.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b6ff16b-9958-432c-bad9-5260d549117a
trendmicro xcsset xcode project 2020ATTACK:enterprise:S0482 → uses → ATTACK:enterprise:T1098.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6723c87e-f60a-465f-96cd-78d63d17ba01
MacKeeper Bundlore Apr 2019ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1098.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--689e111e-688e-4eb6-923f-2ec03670b763
AI-Mexico-Govt-BreachATTACK:enterprise:T1098.004 → subtechnique-of → ATTACK:enterprise:T1098
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8b86fa49-6d13-42b4-bd48-814abfd6793f
ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1098.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8faa230d-ced2-4289-81c5-554fd6dc62fd
Broadcom ESXi SSHATTACK:enterprise:C0061 → uses → ATTACK:enterprise:T1098.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b5bee386-9f09-4911-922e-8975b22f6d9c
sentinelone operationDigitalEye Dec 2024ATTACK:enterprise:G0139 → uses → ATTACK:enterprise:T1098.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d6e1026a-a33e-46a3-832e-ff9b36d52c07
Cisco Talos Intelligence Group · Aqua TeamTNT August 2020