Live Linux Forensics training coming up @WWHackinFest Deadwood! Let's do some daily Linux Forensics trivia as a lead-up! wildwesthackinfest.com/deadw…
34
50
2
95
Replying to @hal_pomeranz @WWHackinFest
Daily Linux Forensics Trivia #18 - During an IR you find a script used by the attackers that is gathering known_hosts and id_* files from user $HOME/.ssh directories. What would the attacker use these files for?

Sep 23, 2022 · 10:34 AM UTC

3
2
Trivia Answer #18 - @MalwareJake points out that determining attacker intent is always difficult, but known_hosts files plus SSH keys (id_* files) are useful for attempts at lateral movement. Enabling the HashKnownHosts option and using strong pass phrases on keys slows attackers
3
Replying to @hal_pomeranz @WWHackinFest
Lateral movement using SSH key pairs?
Replying to @hal_pomeranz @WWHackinFest
Could be anything, like making a collage for mom. Threat actor intent is hard to pin down. But in this case, I'd be using them for lateral movement, hoping the known_hosts files aren't hashed and that one or more the id_* files are valid ssh private keys to get me access.
1
GIF