From 763e2eed8be768f7381dc08e83a503264d87762e Mon Sep 17 00:00:00 2001
From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com>
Date: Fri, 6 May 2022 13:58:32 -0400
Subject: [PATCH] Update linux_deletion_of_ssh_key.yml

Check for deletion of SSH key material in the ~/.ssh directory as well. Not just in /etc/ssh.
This particular commit fixes minor logic error in including content in the ~/.ssh directory
---
 detections/endpoint/linux_deletion_of_ssh_key.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/detections/endpoint/linux_deletion_of_ssh_key.yml b/detections/endpoint/linux_deletion_of_ssh_key.yml
index 5b5495460d..2123fef0d5 100644
--- a/detections/endpoint/linux_deletion_of_ssh_key.yml
+++ b/detections/endpoint/linux_deletion_of_ssh_key.yml
@@ -12,7 +12,7 @@ description: This analytic is to detect a deletion of ssh key in a linux machine
   acidrain malware does in linux or router machines. This detection can be a good pivot to check what process and user
   tries to delete this type of files which is not so common and need further investigation.
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem
-  where Filesystem.action=deleted Filesystem.file_path = "/etc/ssh/*" AND Filesystem.file_path = "~/.ssh/*"
+  where Filesystem.action=deleted AND Filesystem.file_path IN ("/etc/ssh/*", "~/.ssh/*")
   by _time span=1h Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.process_guid Filesystem.action
   | `drop_dm_object_name(Filesystem)`
   |rename process_guid as proc_guid