name: Unusual access to SSH keys
id: 90f5c1bd-abd6-4d1b-94e0-229f04473d60
version: 1.0.0
description: |
  Identifies access by unusual process to saved SSH keys.
labels:
  tactic.id: TA0006
  tactic.name: Credential Access
  tactic.ref: https://attack.mitre.org/tactics/TA0006/
  technique.id: T1552
  technique.name: Unsecured credentials
  technique.ref: https://attack.mitre.org/techniques/T1552/
  subtechnique.id: T1552.001
  subtechnique.name: Credentials In Files
  subtechnique.ref: https://attack.mitre.org/techniques/T1552/001/

condition: >
  open_file
    and
  file.name imatches '?:\\Users\\*\\.ssh\\known_hosts'
    and
    not
  ps.exe imatches
    (
      '?:\\Program Files\\*',
      '?:\\Program Files(x86)\\*',
      '?:\\ProgramData\\Microsoft\\Windows Defender\\*\\MsMpEng.exe',
      '?:\\Windows\\System32\\svchost.exe'
    )
    and
    not
  ps.name imatches
    (
      'PuTTYNG.exe',
      'putty*.exe',
      'ssh.exe',
      'WinSCP.exe'
    )

min-engine-version: 2.0.0
