YARA Detection Rule: VULN_Unencrypted_SSH_Private_Key_Root_Folder
Repository: Neo23x0/signature-base
Detects: Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty
Author: Arnim Rupp
Reference: https://attack.mitre.org/techniques/T1552/004/

Pattern signatures:
/*
            [CREDENTIAL_REDACTED]
            MII
        */
        $openssh_rsa = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 49 }

        /*
            -----BEGIN DSA PRIVATE KEY-----
            MIIBvAIBAAKBgQ
        */
        $openssh_dsa = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 44 53 41 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 49 42 76 41 49 42 41 41 4b 42 67 51 }

        /*
            [CREDENTIAL_REDACTED]
            M
        */
        $openssh_ecdsa = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 43 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d }

        /*
            [CREDENTIAL_REDACTED]
            b3BlbnNzaC1rZXktdjEAAAAABG5vbmU

            base64 contains: openssh-key-v1.....none
        */
        $openssh_ed25519 = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 4f 50 45 4e 53 53 48 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 0a 62 33 42 6c 62 6e 4e 7a 

Detection condition:
/*
            limit to folders and filenames which are known to contain ssh keys to avoid triggering on all those
            private keys for SSL, signing, ... which might be important but aren't usually used for lateral
            movement => bad signal noise ratio
        */
        (
         

Full rule:
rule VULN_Unencrypted_SSH_Private_Key_Root_Folder : T1552_004 {
    meta:
        description = "Detects unencrypted SSH private keys with DSA, RSA, ECDSA and ED25519 of openssh or Putty"
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        author = "Arnim Rupp"
        date = "2023-01-06"
        reference = "https://attack.mitre.org/techniques/T1552/004/"
        score = 65
        id = "9e6a03a1-d95f-5de7-a6c0-a2e77486007c"
    strings:
        /*
            [CREDENTIAL_REDACTED]
            MII
        */
        $openssh_rsa = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 52 53 41 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 49 }

        /*
            -----BEGIN DSA PRIVATE KEY-----
            MIIBvAIBAAKBgQ
        */
        $openssh_dsa = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 44 53 41 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d 49 49 42 76 41 49 42 41 41 4b 42 67 51 }

        /*
            [CREDENTIAL_REDACTED]
            M
        */
        $openssh_ecdsa = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 45 43 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 0a 4d }

        /*
            [CREDENTIAL_REDACTED]
            b3BlbnNzaC1rZXktdjEAAAAABG5vbmU

            base64 contains: openssh-key-v1.....none
        */
        $openssh_ed25519 = { 2d 2d 2d 2d 2d 42 45 47 49 4e 20 4f 50 45 4e 53 53 48 20 50 52 49 56 41 54 45 20 4b 45 59 2d 2d 2d 2d 2d 0a 62 33 42 6c 62 6e 4e 7a 61 43 31 72 5a 58 6b 74 64 6a 45 41 41 41 41 41 42 47 35 76 62 6d 55 }

        $putty_start = "PuTTY-User-Key-File" ascii
        $putty_noenc = "Encryption: none" ascii

    condition:
        /*
            limit to folders and filenames which are known to contain ssh keys to avoid triggering on all those
            private keys for SSL, signing, ... which might be important but aren't usually used for lateral
            movement => bad signal noise ratio
        */