You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
So many of the successful logins are just a set of commands intended to add new SSH keys to ~/.ssh/authorized_keys. Many of them actually follow up with a key-based login attempt, but we don't support keys, so they fail. Allow actors to authenticate to certain accounts with keys (as well as with passwords) to capture the follow-up to this sort of activity. Make sure to log the key info, too, which could be helpful for campaign tracking.
The text was updated successfully, but these errors were encountered:
So many of the successful logins are just a set of commands intended to add new SSH keys to
~/.ssh/authorized_keys
. Many of them actually follow up with a key-based login attempt, but we don't support keys, so they fail. Allow actors to authenticate to certain accounts with keys (as well as with passwords) to capture the follow-up to this sort of activity. Make sure to log the key info, too, which could be helpful for campaign tracking.The text was updated successfully, but these errors were encountered: