Ssh

SSH Private Keys

Private keys commonly used for SSH authentication.

Metadata

id: ssh.private-keys
category: ssh
sensitivity: critical
artifact types: credential, private-key
tags: ssh, authentication, private-key

Path Matchers

Path	Kind	Platforms
`%USERPROFILE%\.ssh\id_rsa`	`file`	`windows`
`%USERPROFILE%\.ssh\id_ed25519`	`file`	`windows`
`%USERPROFILE%\.ssh\id_ecdsa`	`file`	`windows`
`%USERPROFILE%\.ssh\id_dsa`	`file`	`windows`
`%USERPROFILE%\.ssh\id_*`	`glob`	`windows`
`$HOME/.ssh/id_rsa`	`file`	`linux`, `macos`
`$HOME/.ssh/id_ed25519`	`file`	`linux`, `macos`
`$HOME/.ssh/id_ecdsa`	`file`	`linux`, `macos`
`$HOME/.ssh/id_dsa`	`file`	`linux`, `macos`
`$HOME/.ssh/id_*`	`glob`	`linux`, `macos`

Content Indicators

Regular expressions:

-----BEGIN OPENSSH PRIVATE KEY-----
-----BEGIN RSA PRIVATE KEY-----
-----BEGIN EC PRIVATE KEY-----

Credential Types

private-key

Impact

credential_access
lateral_movement
remote_access

References

SSH Known Hosts

SSH known_hosts files can reveal previously accessed hosts.

PuTTY Private Keys

PuTTY private key files can contain SSH private keys used for remote access.

On this page

Metadata Path Matchers Content Indicators Credential Types Impact References