AN0351: Analytic 0351
Insertion of public keys into authorized_keys using bash/zsh or editor tools, correlated with suspicious process ancestry.
Analyst context for executives and security teams
This analytic matters because changes to SSH authorized_keys on macOS can create or preserve remote access that bypasses normal interactive login workflows. For leaders, the decision value is whether the organization can reliably see and investigate unauthorized persistence-related changes on macOS endpoints, especially when the change is made through shells or editor tools with unusual parent processes.
Executive priority
Prioritize this as a macOS endpoint visibility and incident-response readiness question: can the SOC prove who changed authorized_keys, from which process chain, and whether the activity was expected administration? This supports operational resilience, access governance, and audit evidence for privileged or remote access control. Because ATT&CK provides no tactic or relationship context for this analytic, treat it as a targeted detection validation item rather than a broad risk claim.
Technical view
Validate monitoring for macOS file modifications involving SSH authorized_keys and correlate those events with process ancestry. The supplied analytic specifically calls out insertion of public keys using bash/zsh or editor tools, with suspicious parent-child process context. SOC and detection teams should test whether endpoint telemetry captures file write events, command/process execution, shell/editor activity, user context, and parent process lineage with enough fidelity to distinguish authorized administration from anomalous access changes.
Likely telemetry
- macOS endpoint file modification events for SSH authorized_keys locations
- Process execution telemetry for bash, zsh, and editor tools
- Parent-child process ancestry and command-line metadata where available
- User/account context associated with the file change
- Timestamps needed to correlate file writes with process activity
Detection direction
- Confirm that macOS endpoints actually collect file write telemetry for authorized_keys and retain it long enough for investigation.
- Correlate authorized_keys modifications with process ancestry rather than relying only on filename matching.
- Tune for legitimate administrative workflows to reduce false positives, especially expected shell or editor usage by administrators.
- Review blind spots where endpoint controls lack command-line capture, parent process lineage, or user context.
- Because no official detection logic is supplied, validate any implementation locally before treating it as production coverage.
Mitigation priorities
- Establish approved administrative procedures for SSH key changes on macOS systems.
- Restrict and review permissions around SSH configuration and authorized_keys files where operationally feasible.
- Use endpoint monitoring and alerting for unexpected authorized_keys changes on macOS.
- Ensure incident response playbooks include validation of SSH key additions, responsible user, process ancestry, and whether access should be revoked.
- Maintain audit evidence showing authorized remote access changes and review activity.
Analyst notes and limits
The object is a MITRE ATT&CK detection analytic, AN0351, for macOS. Its only behavioral description is insertion of public keys into authorized_keys using bash/zsh or editor tools, correlated with suspicious process ancestry. No ATT&CK tactics, relationships, labels, aliases, or official detection logic were supplied.
This take is limited to the supplied STIX fields and external reference. It does not infer active exploitation, threat actor use, impact, or guaranteed detection. Local endpoint logging, macOS management practices, and approved SSH administration workflows are required to assess material risk and tune detections.
Analytic 0351
Insertion of public keys into authorized_keys using bash/zsh or editor tools, correlated with suspicious process ancestry.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | 34cce0cbb508… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0351Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.