Agent Weakening of Host Authentication Configuration - ATR-2026-01992 (d8f1a843-fc1f-584d-bf60-2ba30f7fbb42)
Detects an agent tool call that modifies host authentication to weaken or backdoor it: appending an SSH public key to authorized_keys, enabling PermitRootLogin, inserting pam_permit / disabling PAM auth modules, or writing NOPASSWD sudoers entries. This is the agent-context form of ATT&CK T1556 (Modify Authentication Process). Detects: writes/edits to authorized_keys, sshd_config, PAM, sudoers that weaken authentication. Does NOT detect: reading or fingerprinting these files, tightening them (chmod 600, PermitRootLogin no), or discussing them in prose.