SSH key / private key theft
Private keys harvested or attacker keys added to authorized_keys
categoryIdentity, authentication and credential attacksseverityHighdetectability (measured in our lab)Lowlabpartially detected
Detection opportunity what to watch for
A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.
What the attacker runs
sudo /opt/lab/detonate.sh --technique T1098.004 --tool atomic --run-id run-2026-10-20-001 -- pwsh -c 'Import-Module invoke-atomicredteam; Invoke-AtomicTest T1098.004 -TestGuids 342cc723-127c-4d3a-8292-9c0c6b4ecadc -PathToAtomicsFolder /opt/AtomicRedTeam/atomics -TimeoutSeconds 120'What our lab measured
partially detected linux · 2026-10-20
Plus 3 stock Wazuh/Sysmon rule(s) in the window.
Background noise in the window: ~194 incidental alerts/hour — tune against this.
Classification
33 values: 9 reviewed, 2 lab-measured, 16 imported, 6 derived. What do these mean?
Exploitability
| Attack vector | Credential attacks |
|---|---|
| Reach (CVSS) | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Attacker skill required | High |
| Resources required | Low |
| Likelihood / prevalence | High |
| Maturity | Commoditized |
Impact & scope
| Severity | High |
|---|---|
| Impact | ConfidentialityIntegrity |
| Platform | ESXiIaaSLinuxmacOSNetwork DevicesWindows |
| Environment | CloudOn-premises |
| Target asset class | Identity |
| Kill-chain phase (tactic) | Credential AccessPersistencePrivilege Escalation |
Detection & telemetry
| Detectability (measured in our lab) | Low |
|---|---|
| Detectability (public detection content) | High |
| Noise level | High |
| Testability | Atomic Red Team test |
| Data sources (ATT&CK data components) | Command ExecutionFile AccessFile CreationFile ModificationProcess Creation |
Detection & response
Mitigated by 22
- M1018 attack-mitigation
- M1022 attack-mitigation
- M1027 attack-mitigation
- M1041 attack-mitigation
- M1042 attack-mitigation
- M1047 attack-mitigation
D3-AAd3fendD3-ALd3fendD3-AMd3fendD3-ANCId3fendD3-CCSAd3fendD3-CDPd3fendD3-CHd3fendD3-CRd3fendD3-CROd3fendD3-CTSd3fendD3-DUCd3fendD3-MFAd3fendD3-RICd3fendD3-RUAAd3fendD3-UAPd3fendD3-ULAd3fend
Detected by 9
- DET0126 attack-detection-strategy
- DET0549 attack-detection-strategy
1f978c6a-4415-47fb-aca5-736a44d7ca3dsigma213d6a77-3d55-4ce8-ba74-fcfef741974esigma7892ec59-c5bb-496d-8968-e5d210ca3ac4sigma9e716b33-63b2-46da-86a4-bd3c3b9b5dfbsigmaaa7a3fce-bef5-4311-9cc1-5f04bb8c308csigmab2815d0d-7481-4bf0-9b6c-a4c48a94b349sigmadca1b3e8-e043-4ec8-85d7-867f334b5724sigma
Tested by 18
12e4a260-a7fd-4ed8-bf18-1a28c1395775atomic290df60e-4b5d-4a5e-b0c7-dc5348ea0c86atomic2a5a0601-f5fb-4e2e-aa09-73282ae6afcaatomic336b25bf-4514-4684-8924-474974f28137atomic342cc723-127c-4d3a-8292-9c0c6b4ecadcatomic42c55554-3dcb-4df6-8fbb-c8ccacc478d4atomic46959285-906d-40fa-9437-5a439accd878atomic520ce462-7ca7-441e-b5a5-f8347f632696atomic5e417277-0ae7-4ad5-a3e8-0fa27c122b29atomic7617f689-bbd8-44bc-adcd-6f8968897848atomic78b274f8-acb0-428b-b1f7-7b0d0e73330aatomic78e95057-d429-4e66-8f82-0f060c1ac96fatomic7c247dc7-5128-4643-907b-73a76d9135c3atomic864bb0b2-6bb5-489a-b43b-a77b3a16d68aatomic922b1080-0b95-42b0-9585-b9a5ea0af044atomicb05ac39b-515f-48e9-88e9-2f141b5bcad0atomiccab413d8-9e4a-4b8d-9b84-c985bd73a442atomice7568442-1b7d-4380-a933-b269d1326b6catomic
Attack relationships
- Parent: API key / secret leakage
- Parent: CI/CD credential hygiene failures
Lab findings
Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.
| Run | Outcome | Tool | Platform | Ran at |
|---|---|---|---|---|
run-2026-10-20-001 | partially-detected | atomic | linux | 2026-10-20 |
run-2026-10-20-001— Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=1). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1098.004 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=5 max_level=3 dwell_s=90
Framework references
- Primary source: https://attack.mitre.org/techniques/T1098/
- attack: T1552.004 (primary)
- attack: T1098.004
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Identity, authentication and credential attacks' table, line 371 of Cyber-Attack-Taxonomy.md
- ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 23 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0003 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 7 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
- ev-0004 (Phase 4 detection lab - detonation runs 2026-10-20) — Lab detonation run-2026-10-20-001 (partially-detected) for T1098.004: no alert matched the expected technique