AN1071: Analytic 1071
Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.
Analyst context for executives and security teams
This analytic describes Linux activity where bash scripts or tools recursively inspect user home directories, configuration files, or SSH key material. For leaders, the practical concern is not the script itself but what it can expose: credentials, access paths, and sensitive local configuration that may support follow-on compromise. Because MITRE provides no official detection logic for this analytic, organizations should treat it as a validation prompt for Linux endpoint visibility and credential-protection monitoring rather than as a ready-to-deploy rule.
Executive priority
Prioritize this where Linux systems host administrators, developers, service accounts, automation keys, or sensitive configuration. The decision value is determining whether the SOC can see suspicious recursive access to home directories and SSH-related files, whether incident responders can prove what was accessed, and whether identity and access controls reduce the damage if private keys or config secrets are discovered. This is also relevant to audit and compliance evidence around privileged access, key handling, and endpoint logging on Linux systems.
Technical view
For SOC, detection engineering, and IR teams, validate Linux telemetry that can show shell-driven or tool-driven recursive file enumeration in user home paths, especially access patterns involving configuration directories and SSH key locations. Since the ATT&CK object does not specify tactics, relationships, or a detection procedure, build local hypotheses around unusual process/file-access combinations, command interpreters such as bash, recursive traversal indicators, and access to files that normally have a narrow administrative or user-specific access pattern. Baseline legitimate administrative, backup, indexing, compliance-scanning, and developer tooling before alerting aggressively.
Likely telemetry
- Linux process execution telemetry, including shell invocation and command-line arguments where available
- File access or file audit events for user home directories, configuration files, and SSH-related paths
- Endpoint detection and response events from Linux hosts
- Authentication and account context tying file access to users, service accounts, or privileged sessions
- Sudo or privilege escalation logs where enumeration occurs under elevated context
Detection direction
- Confirm whether Linux hosts generate and retain process and file-access telemetry sufficient to reconstruct recursive enumeration activity.
- Tune for unusual breadth or speed of reads/listing operations across multiple home directories or sensitive configuration locations, not just single-file access.
- Prioritize access to SSH key material and configuration files when performed by unexpected users, service accounts, scripts, or parent processes.
- Account for expected noise from backups, vulnerability scanners, configuration management, endpoint inventory, developer searches, and administrative maintenance.
- Correlate file enumeration with authentication context, privilege changes, and subsequent access attempts where local telemetry permits.
Mitigation priorities
- Reduce exposure of SSH keys and sensitive configuration through least privilege, correct file permissions, and disciplined key management on Linux systems.
- Limit unnecessary access to other users’ home directories, especially from shared administrative or service accounts.
- Harden and monitor privileged accounts used on Linux hosts, including sudo usage and automation accounts.
- Maintain endpoint logging on Linux systems that supports incident reconstruction for process execution and sensitive file access.
- Review operational tools such as backup, scanning, and configuration management so legitimate recursive access is identifiable and documented.
Analyst notes and limits
This take is based only on the supplied ATT&CK analytic AN1071. The official object identifies Linux as the platform and describes recursive enumeration of user home directories, config files, or SSH keys using bash scripts or tools. No tactics, relationships, aliases, labels, or official detection content were supplied, so recommendations are framed as defensive validation guidance rather than a specific ATT&CK detection implementation.
Coverage depends heavily on local Linux logging, EDR configuration, file audit scope, and knowledge of legitimate administrative tooling. The supplied ATT&CK fields do not establish adversary attribution, active exploitation, business impact, or guaranteed detectability.
Analytic 1071
Adversaries using bash scripts or tools to recursively enumerate user home directories, config files, or SSH keys.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | e1cb29020fd7… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN1071Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.