detection rulehost
Hunt for n4d SSH persistence key
- First seen
- 2026-07-18
- Last seen
- 2026-07-18
- Used in
- 1 post
# Hunt for n4d SSH persistence key
grep 'AAAAC3NzaC1lZDI1NTE5AAAAIJKH4g/SD6c00i5PzlWWkwXJwIHEac+nlAjg6WeOHUq3' /root/.ssh/authorized_keys ~/.ssh/authorized_keys 2>/dev/nullPosts using this rule
Host
The SSH key is a definitive indicator of n4d compromise. Confirmed in both detonation and live Docker capture.