topic Re: Detect SSH key without passphrase in Cortex XDR Discussions

Detect SSH key without passphrase

A.Yoon — Thu, 05 Jun 2025 15:41:39 GMT

Is there a way to detect SSH key without passphrase in user laptop using Cortex XDR? Thanks.

Re: Detect SSH key without passphrase

eluis — Wed, 11 Jun 2025 09:25:24 GMT

Hi A.Yoon

Could you please elaborate further your question ? Im not sure I understand what you want to achieve or in which way you want to detect ssh key

KR,

Luis

Re: Detect SSH key without passphrase

eluis — Wed, 11 Jun 2025 10:12:13 GMT

Hi A.Yoon again,

After reading again your question, if I understood properly, let me answer:

Cortex XDR does not natively detect SSH keys without passphrases, you can achieve reasonable detection coverage using a combination of file monitoring, scripting, and custom XQL rules.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.
Luis