Detect SSH key without passphrase

[A.Yoon]

Is there a way to detect SSH key without passphrase in user laptop using Cortex XDR? Thanks.

[eluis]

Hi A.Yoon

Could you please elaborate further your question ? Im not sure I understand what you want to achieve or in which way you want to detect ssh key

KR, 

Luis 

[eluis]

Hi A.Yoon again, 

After reading again your question, if I understood properly, let me answer: 

Cortex XDR does not natively detect SSH keys without passphrases, you can achieve reasonable detection coverage using a combination of file monitoring, scripting, and custom XQL rules.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.
Luis