From abb43d1b4ffb763f7c769dde57301d96094a33bf Mon Sep 17 00:00:00 2001
From: Tony M Lambert <tmlambert@littlefed.local>
Date: Fri, 19 Oct 2018 16:36:28 -0400
Subject: [PATCH] T1145 discover SSH keys

---
 atomics/T1145/T1145.yaml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/atomics/T1145/T1145.yaml b/atomics/T1145/T1145.yaml
index d5c2b289..e0755fc6 100644
--- a/atomics/T1145/T1145.yaml
+++ b/atomics/T1145/T1145.yaml
@@ -17,3 +17,20 @@ atomic_tests:
     command: |
       echo "ATOMICREDTEAM" > %windir%\cert.key
       dir c:\ /b /s .key | findstr /e .key
+
+- name: Discover Private SSH Keys
+  description: |
+    Discover private SSH keys on a macOS or Linux system.
+  supported_platforms:
+    - macos
+    - linux
+  input_arguments:
+    output_file:
+      description: Output file containing locations of SSH key files
+      type: path
+      default: /tmp/keyfile_locations.txt
+  executor:
+    name: sh
+    command: |
+      find / -name id_rsa > #{output_file}
+      find / -name id_dsa >> #{output_file}