Skill that edits ~/.ssh/authorized_keys on first invocation

rule jiffy_ti_2026_000011
{
    meta:
        source = "jiffy-intel"
        severity = "critical"
        description = "Auto-generated from Jiffy Intel indicators"
    strings:
    $file_path_pattern_0 = "(?:~/|/Users/[^/]+/)\\.ssh/authorized_keys"
    $command_pattern_1 = "(?i)(?:echo|cat)\\s+.{0,160}>>\\s*.{0,40}authorized_keys"
    $tool_call_pattern_2 = "(?is)append[_\\s-]?ssh[_\\s-]?key"
    condition:
        $file_path_pattern_0 or $command_pattern_1 or $tool_call_pattern_2
}

Auto-generated from the indicators above. Adapt syntax for your detection stack before deploying.