Update PrivateKeys.yaml (#1459)

Co-authored-by: Mike Cohen <[email protected]> Co-authored-by: Mike Cohen <[email protected]>
Velocidex · Jan 3, 2022 · dc02b45 · dc02b45
1 parent 5c4390e
commit dc02b45
Show file tree

Hide file tree

Showing 11 changed files with 387 additions and 10 deletions.
diff --git a/artifacts/definitions/Linux/Ssh/PrivateKeys.yaml b/artifacts/definitions/Linux/Ssh/PrivateKeys.yaml
@@ -4,23 +4,129 @@ description: |
   private keys are more risky because an attacker can use them without
   needing to unlock them with a password.
 
+  In particular, AWS instances are usually accessed by way of an SSH
+  key pair generated by the AWS console. This key is not encrypted by
+  default and it is possible that administrators simply save the key
+  on their systems without encrypting it.
+
   This artifact searches for private keys in the usual locations and
-  also records if they are encrypted or not.
+  also records if they are encrypted or not. Not all key types are
+  supported
+
+  NOTE: In order to encrypt your private key run:
+
+  ```
+  ssh-keygen -p -f my_private_key
+  ```
+
+  Change the glob to /** if you would like to search the entire filesystem.
+  Be aware, this is an expensive operation.
 
   ## references
   - https://attack.mitre.org/techniques/T1145/
 
+reference:
+  - https://coolaj86.com/articles/the-openssh-private-key-format/
+  - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html
+
 precondition: SELECT OS From info() where OS = 'linux'
 
 parameters:
   - name: KeyGlobs
-    default: /home/*/.ssh/id_{rsa,dsa}
+    default: /home/*/.ssh/{*.pem,id_rsa,id_dsa}
 
 sources:
-  - queries:
-      - SELECT FullPath,
-               Mtime,
-               if(condition={
-                     SELECT * from yara(rules="wide ascii:ENCRYPTED", files=FullPath)
-                  }, then="Yes", else="No") AS Encrypted
-        FROM glob(globs=KeyGlobs)
+  - query: |
+      -- For new OpenSSH format
+      LET SSHProfile = '''[
+        ["Header", 0, [
+        ["Magic", 0, "String", {
+            "length": 100,
+        }],
+        ["cipher_length", 15, "uint32b"],
+        ["cipher", 19, "String", {
+            "length": "x=>x.cipher_length",
+        }]
+      ]]]
+      '''
+
+      -- Device major numbers considered local. See Linux.Search.FileFinder
+      LET LocalDeviceMajor <= (
+          253, 7, 8, 9, 11, 65, 66, 67, 68, 69, 70,
+          71, 128, 129, 130, 131, 132, 133, 134, 135, 253)
+
+      // Only search local filesystems
+      LET RecursionCallback = "x=>x.Data.DevMajor IN LocalDeviceMajor"
+
+      LET _Hits = SELECT FullPath,
+           read_file(filename=FullPath, length=20240) AS Data
+        FROM glob(globs=KeyGlobs, recursion_callback=RecursionCallback)
+        WHERE Size < 20000
+
+      LET Hits = SELECT FullPath, Data,
+             base64decode(
+                string=parse_string_with_regex(
+                    string=Data,
+                    regex="(?sm)KEY-----(.+)-----END").g1) AS Decoded,
+            parse_string_with_regex(
+               string=Data,
+               regex="(BEGIN.* PRIVATE KEY)").g1 AS Header
+      FROM _Hits
+      WHERE Header
+
+      LET OpenSSHKeyParser(FullPath, Decoded) = SELECT FullPath,
+         parse_binary(accessor="data", filename=Decoded,
+                      profile=SSHProfile, struct="Header") AS Parsed
+         FROM scope()
+
+      -- Support both types of ssh keys dependingg on the header
+      SELECT * FROM foreach(row={SELECT * FROM Hits},
+      query={
+        SELECT * FROM switch(
+          a={
+             -- new format
+             SELECT FullPath,
+                    Parsed.Magic AS KeyType,
+                    Parsed.cipher AS Cipher,
+                    Header
+             FROM OpenSSHKeyParser(FullPath=FullPath, Decoded=Decoded)
+             WHERE Header =~ "BEGIN OPENSSH PRIVATE KEY"
+          },
+          a2={
+             -- encrypted rsa key from e.g. putty
+             SELECT FullPath,
+                    "PKCS8" AS KeyType,
+                    parse_string_with_regex(string=Data,
+                      regex="DEK-Info: ([-a-zA-Z0-9]+)").g1 AS Cipher,
+                    Header
+             FROM scope()
+             WHERE Header =~ "BEGIN RSA PRIVATE KEY"
+               AND "Proc-Type: 4,ENCRYPTED" in Data
+          },
+          b={
+             -- unencrypted rsa key from e.g. AWS
+             SELECT FullPath,
+                    "PKCS8" AS KeyType,
+                    "none" AS Cipher,
+                    Header
+             FROM scope()
+             WHERE Header =~ "BEGIN (RSA )?PRIVATE KEY"
+          },
+          c={
+             -- old format encrypted
+             SELECT FullPath,
+                    "PKCS8" AS KeyType,
+                    "PKCS#5" AS Cipher,
+                    Header
+             FROM scope()
+             WHERE Header =~ "BEGIN ENCRYPTED PRIVATE KEY"
+          },
+          d={
+             -- catch all for unknown keys
+             SELECT FullPath,
+                    "Unknown" AS KeyType,
+                    "Unknown" AS Cipher,
+                    Header
+             FROM scope()
+          })
+      })
diff --git a/artifacts/testdata/files/keys/EncryptedRSAKeyPair.pem b/artifacts/testdata/files/keys/EncryptedRSAKeyPair.pem
@@ -0,0 +1,30 @@
+-----BEGIN RSA PRIVATE KEY-----
+Proc-Type: 4,ENCRYPTED
+DEK-Info: DES-EDE3-CBC,C4E12C27A0C03258
+
+UxZBq/UjsULjLsZaTGQ9ECVK0l4KJfXYnJrwOauGOI0w5rzXwRJdQ1HBxOg9PFDH
+Icom2EIyONOiKznu54MNdKAKmeLDVno2H0iZp1mCJIk44eS04HZC3mBYsgo1y8Tx
+YPqDZ6XyTpFgcb0q5Lb2p845MXmEghZ67sNoAxr9Z1S4Db7O5qUAK5RwGfn9yMHn
+cSi0jAdqsF+Su7Hqe65ZJNtbXeU4grGGGD1ATS7KdDJp4sHi2z8oye3L1bFAoRV9
+3R2/7ho0jkjTQMpHb66a2lajYsxIBNeEhQpv5XSg0IK23vtaMNbzWSq+BHL/sNrD
+CNwv6iW60uJcp5uxxKrCRhyjqK8yyyJN2U/PSbY2zS2Wo0st0US8uvJHgFa3T35w
+zXnCsb6vLqzmSC7KaT5bg60fUTsNB83wSLDYWeCpXIQIvJBfSJ60kP2Gt06B4qWX
+6497aX8DaRMA1ulzlzhLrK72HHHeULFeVyRCGybl94zrL4/W7OTRJODpQ9X0tTIb
+eovchoq+8f9gx3IuYzDGPnPF/kSOA1/pNz3l9ma/hJcYJpJ6r5JT8+/Lnc7Kp+Jy
+SI3GCPKu/iy00PJ29sTL8elzuoDWzZsfedaiQz7sHe4VHIegT3HtzldZ8VG5f1ts
++jtFYttY85nME12ikcAr8ARfiHgavxn05D5troaxX9EC1WzVT5rwnLk5Xfx2R5L6
+P6CGxMZLqtdg+MCPmV7l8wGMF0s/Fe8h5EvmXkIXXj3k+bYrUObwGBJ9bnTLYmgr
+aauY9psjkIpwFcCVQt0mHVLevkgwb4wo/bninz0MHvo7HxJ3JqJIlgKs0npluBmD
+k7UazT8Kjn8pGYYkmf1YoHPutaahEdnvzhARQrdsvo4xtZAWbOHZU5AmEdIxXUrp
+2D6JMVruQudwaBjAVgyYcfb8RvRQ4OTN1SQj5xmJuayFy7tggjm6ax3xviPGiLp6
+e+CUy1q/rwuiH7O2yeIk47Cmwa2OiG0cXPVNk7X5jP09FkZDRuN7Qn2DsI2RM06S
+CnjagSWFeo33goySCKOn+MAHEI39YGX6i0ZDJP8BF9uOCQ8/LxUc+byuFuYUho66
+ZJ5tj4+juBN8LDWheGrLUhOLPvhMGgC+Ibk9wNHw2TSBny9BtLOFCgwjAwWdliTc
+QoTfJf5b/oumyQTwFRYihKqItNdshFwmXsdmyEwlej1aoNdEzhS49kmswAIFROY2
+3njXucvguHRlQ/JcF3IKN/TdnxWgqw82iRgN1TsMTYH5T4jEaeWPd7P7sqEdPgme
+QO7SOKW/dpIhLdepbQPUjH0jNaSdcfCDwEU0dLZ2a88KqausLWposoaFrmt36gcz
+0lOsgUhwa2dvIjEE9FXAAPIuMbnXDbrkAu9aM1sM2eM7NplA8JxxT+j7zdAH1ANu
+PfKGXGCxLsbKPGrQbxqnbuwdUv8ODt7TG6KdhbygbgwJ8mh9xYiPNs1K7RTA3Jip
+sZZzKNQ0l/G8w/kbv0lxsy359OE0XXk24tI6J0hh8cCqSRbapZEVCLHlEYst+Yrh
+NnbOfAbwgt+BYD7hqa3+5DIjXyOonvCnTCV8JtN4KLolgXTQQuUJjkZG5PfVN6/t
+-----END RSA PRIVATE KEY-----
diff --git a/artifacts/testdata/files/keys/UnencryptedED25519KeyPair.pem b/artifacts/testdata/files/keys/UnencryptedED25519KeyPair.pem
@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtz
+c2gtZWQyNTUxOQAAACB0M7NQwWgHF3xirTctmn/yw9tpd3vRdRBK8Z9oIGTJ4gAA
+AIhf0wxxX9MMcQAAAAtzc2gtZWQyNTUxOQAAACB0M7NQwWgHF3xirTctmn/yw9tp
+d3vRdRBK8Z9oIGTJ4gAAAEAwUQIBATAFBgMrZXAEIgQgp08TdS3yr6NMV4lPZzPn
+CXQzs1DBaAcXfGKtNy2af/LD22l3e9F1EErxn2ggZMniAAAAAAECAwQF
+-----END OPENSSH PRIVATE KEY-----
diff --git a/artifacts/testdata/files/keys/UnencryptedRSAKeyPair.pem b/artifacts/testdata/files/keys/UnencryptedRSAKeyPair.pem
@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAxA8IYuhOq7MRmySJ2uUAoCUxLyBhTvoS5nxsnmW6DrPSSJEo
+yxVQbGkMU4T0Pz7onGkCHiIF5yDdJXnl5MoCyExIa8Zk2w13ElMTdlKaKW33DOkm
+Ht38kXfdMIO782DDElTkNk9nfqNnABvFzq1DZry1ubxkcrZHMBY757b9kVuQZeZw
+QAgQn4LMbDGoYO2K76VRRetmsfx8upekG9We6uJXVEhE+O+aq3/xstWPnDBxsv0z
+uBNUfL2F0tW4YuEaibMzENrbxBrYGfDOnIzmiDc13H2g1c9fy7l2cxK6bPtNC5Gl
+8dugCi0RuAvJBmFri9IwhxzMuWKPLfRz/j+TJQIDAQABAoIBAQCv2DvRWkKVRTqZ
+R6BNL+/rsu/2MLiWOT0SdK6HMv45iZcldux7mVZUpbNkhW77+tRu1NANbr6Umqk+
+n6JOHdF5DNI3t+1leyI80T43dcbHOdXHQqXqMXgCkNtWVBETLMpJetJk07sjnjMX
+qdE0mbpGPyNOv2XobQxUWNzJ6xpqb3yGKifuo3XyW6MROeB1Cl5fB6+G9rpwH+R+
+HwSLYYhfD9naExRs1dNuFFinVzFRHtdKr6LE7vNhy/sko6b1vvsDiLpwsCcAM54o
+uhfhkBaZC5zc8o0zKZsgole3/2GcMOD5yTyTFOpN5hsTNse4+Ho732+W5CZM1y5S
+x+KRyoZRAoGBAP3KQkc/kHlekZX5phXKNflEg/apMYbiP4oJ8N5Ku8ij3oBTgpmg
+cZ5BZtXaRTnhmEqI5mo+NJW+PenQTio2BoNepyqkCUQ+KfX1oPq76WFOGxDSFTKq
+v7kPZvX2bNID7o6QxZf0n/kTZSQpEUwbIayVOzlN8W0TSIYcbPMt5XC/AoGBAMXE
+FLUY4F/8l9rPTq3kWYQkzmbmWrcaleM/EcKeSuU0WzOfG0g4npjEcZzHgmmoMnud
+PusdAl6T2tsfgXW1zverP5uJ0C6hZvyaSPYPDFLkoifBgQll92Q2gYlp48MvC3ee
+B6idmm7ooie9EOnM9AVTH0laSaVc6PtZhS4pcBEbAoGBAINojPTzVs1hSCTNxU+X
+CmdtMJ8xcDGVSK0jBJM1QxJat0Te+MqvJuV4m9SzVhDoXMCLLjNozjWS8d/1OePl
+YW34Prp3gUzSm0t9ycLKNcdqd903yj4X53ndHcTRufrsikNLduR9h6+ieUZF9Wzg
+x4jjJG1BjHab+3tlkIxCAYFlAoGANF1kAkOw/Zl7eAOWWLLzBOtd/58U/BC9CWvk
+vvx85k3DrFp/tdLQI7E4SAQHwwQ3QcX0J/sJapOJyqV/+PQH9kpQ0FVgW0h/ZXlQ
+wl5fq/8/9HjnOt7V76IDEKiKF194kNa2Pm5kuuM8NHt6Y/3RyyskSJ7wiymbwxoE
+CqIMO2sCgYA27Eq7Oo/MY8gtvlQ6h8RtH6ZAoIKZHN5BIS5bAVi4A8U22scznb7d
+s1/PEBpAhbYh7hHLMOadp35NCt59y1WEwX7TWZt49RbSUyN/ZYNi8xuP6I1xpHG9
+6iWe96/0/wZDkb4ZCvTsBizfj6OIUWeCVV6t5IWfsPlZ2cetAUYjVw==
+-----END RSA PRIVATE KEY-----
diff --git a/artifacts/testdata/files/keys/encrypted.key.pem b/artifacts/testdata/files/keys/encrypted.key.pem
@@ -0,0 +1,39 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABAfO+geoe
+bUcjzqb2zdIVySAAAAEAAAAAEAAAGXAAAAB3NzaC1yc2EAAAADAQABAAABgQDNMoPvsO10
+3CXOefHjFzLigwWDyMHsL1PsCjfPyKXAnVd/Iq58UXcSKAF9AkrUzqM7EpKD38BCA1dU/F
+GMmNZfIxhumsyZTbs47J7kJJKUopnuI+VOoRPtBxzYUt7NE12aW7QKgkvSmIZiP9nbUSV/
+YxIt+2Q9jP1QF+pYTP2XLgXIynOx1msLxDyRxwjQtezvWD4y3GIMeWJtcCK4XxjjmAYEGI
+zsiO+X2KlhDY4tWVi2oZxH/JF2WxZbZ2NWJ8Gab4JFEhMcNyjzYnQPvQRw0jq4rO8Vqg7/
+78FUpQWZ0srxL5CcS9wfm8LurKsUtFYwmqEq0oNJkOuDdC0eJmHlfWic4jM15Noha9LqXb
+i1QKAAN7jxQmMzv1FpewuXyvthCYbmfJicDrxWMnYLSAxk/qBSHn/vPN5n2U4auxzjxDTV
+iFd00db7I6zt7/k4eK8upnvYN3FUycQdm/6yo7h5ZOn4aH4k+aObhJJB3FpJh33m4WW8l2
+y58vh81fB+UfMAAAWAab+IuvL0MVHWxFYAXenjG5g5VW8wrd4FOfse3af9cZA8AmCUODnN
+1TpCkmlvCYZ/IRSSdq/zb9PJjOLOzfJo49aHViFXot7hLV5Hg8QS1RTOUk/oULnYs7sAws
+3+C8MtYjU1dcMw+Qniefa8/d1XMX2tHWQlbgefRDS8vXPxj59ZATvsnZmIm+1yO5JW38Yj
+erO41MggGB89EGxN5+ZXWULIUlGtJxJWuraHr6ekOKkl7tCy2hKSVl896McJJbljRlKIoN
+nISAeimUZmpE6YGp1j41PPC3CORE6FWR00WOBSRFWtMzSJJ4c4tN9S7hVcdhl7coItBnSG
+6R/ttI3xvqpYwKQEbb4P4CJ5/2iz/Kv6J4AtvGMrhgyw5+XoeTggrWeJ+ztqA2gB1OGyGM
+Opl4nMEtmZ+quR+dY7kqz8YAuWAWTW2ToMox/vPZ71uNNI3Qo/GWbaRzWNDP9xTQsgqMMk
+LXXW0+k4yiQd/Oo8+mqo2ajrTfliy+hPsFre3xqfN9y8H6LQKYQIqX944UybsHygxEy+rj
+LQgTFKSc8QvpJIo4urxa+8j00bgPFeB7dzJ0icH0vu7Jd+Zxqr6UEoO0Z/TK6sn8kiJcdj
+87CSkBwLHYG5hMRh592Gpq2y2eL2deDpKjgxSavwxUsfvdLwUgtsuhZ9pYxPa0z8rEEvdc
+/Rw7/5UROr9215/Q9TIYSIlsYL1d3VCx5a9eUKOlTUQyOi2sZdWL2dgyoRbVmor3WXTyY6
+GKyiYetJWxmrr0fhgpG1pR+mdsy3FeNUxrFeakB5CPxtuWStegSfR2VXAQgbqLa8wPLvAY
+eyGD208kIVUrmqaeSgSlN3x3kommAIZVsnVmX9/jDTDvKv6tzC5t/oiliALkTMKwEM6Z4p
+IBgm6Nc/9O6g0So0OUmcoT/yQJBuZ7pCBqiTGt1fiq09MOSn5/PeNt1+fxkPQA8T0BfQqB
+nVQ+yAMsb0dlkz5KV3MzBT7KFH/BFfXVZyMlfPprvO1Lqlpb7pAH4GhcWm9pznnkZRWhz2
+XeyMmES87tuxqiHXHdqubKBkqSKdAxRXDvhsfl3klQOwR+SuDFg9BCDq0gIFnmxKBNXwpK
+31zoMKrhPnfMo9aZADumYnu2pLn+xMmB7VeOV8EmVR4rLiN9g+uydWFavkM6YGb9kj1YIb
+5xmWtXmwyvikKP6uS0NcJ27FKP/CoFWEpq0DF1YgFVFdXP/ZhrDc7pirpVgj2K7LD8FHfI
+wy6EBofrDVV5kTNDO/OMgRnECYQrSGmwugtaRwE1YOJN459VgQ3jBWQ+mRZdsnQ/QGC5Ft
+t9ia434BSBe/PKFbAQ+Ok4mFy4NeFx1x5VejXJ03cEYmzI6APE2zakeXZdM0lV1HK+PI5c
+fLR/u/lZM0xd6VaV9yJBeavc2fBezFknsTMUWjM/tIs1qQFtbXmdiLpPXp5eEPLMdGeTjP
+JKvUsJUFl+qtro3U9dmgQm6JOLV6hLp8PzGnbhyx4adZwv420ChPBf+YP2a+qwmLMK+UgH
+2g74jO721c6Q3A7V/yFNc2aXcXWicTdCu+44R4weHT4Xdx/lEschko2eWv93+k4We4Ev1G
+E4XwFPL0oF8ixsEzIZtDF/p/us+oFQUy4DHBJM8LiUaMWo8dh0W4G+6xsZRh3/kurVh7O4
+3r5vAPsJrqTvAypzE3qe/AvBqbbCOyfmWsnmlb49NzwS2WdixEXE9tExSTYKslqkOAK/DY
+yb2etbqY8d02NNpXdZze5PpjdEZkQuCgqWhpeLr3EbUa+2vzbtgFCBXFDX/jZN/uNmSH4N
+0ng+9/JFaK6NFrxM9S1MAmtje+Jy8aoLcOdjBAOMall9aIMRbLSFPSUOuzw8lij1LQGgMU
+WR4DLg==
+-----END OPENSSH PRIVATE KEY-----
diff --git a/artifacts/testdata/files/keys/pkcs8_encryped.pem b/artifacts/testdata/files/keys/pkcs8_encryped.pem
@@ -0,0 +1,42 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIHbTBXBgkqhkiG9w0BBQ0wSjApBgkqhkiG9w0BBQwwHAQIFgBG9p4RZXUCAggA
+MAwGCCqGSIb3DQIJBQAwHQYJYIZIAWUDBAECBBAiPaHXxW6B3kG0A8KkGu5SBIIH
+EGsXZHbM9Azy453wY1+s/K+6o527aFJqta25/8Wbkrmd3KRHV4vvspgiR0x4nJgS
+EMl0GRgx04bJCUKWvYaACEijlcBWlMvmAJul0+p+foJjzBDMw4b1DbwT5jC5pD3s
+mv2AYMrk6w8YnUAPRY82rTyFKPVkrQO8nYHTe4bE5sIh9lRgA+H85bsXwI6gQXL4
+nRxYQaCUb4Mk5nJxg+m843xa/L666n28AmqB1HrntW8/9WzU5XVIWhkHIVlz5MN5
+z7ENu6eGlr9SrJ0bOEzzvgigEqH0zmWckswLV55vAW/nWC0LVZl/CE+4zv/Dqxrq
+PhjSHCgxZC5n0M+18LtKAr5w3DdKOeSty/53Zz6ZwUMZnXkJ3CaLbZ1tnqfYrrlV
+cdnhVTKgitTClHl0W563f925ioZXx8lr3Cb3LdUjW3V25bs4lANslgsJWI/UgOVs
+J8ReHKte+/x2YOyRzSrm0orR+s5oNGUotNd01o9flOq6N3z5YILqUpJL7ozrhqN/
+PmDOu/ZCQshBS3WhuZm5+l8DWvky5Iv+KP4BCErDl45jyoUaMCTuaVwtHoViBDZD
+el4TMnO2f1TOdJs3sJMwwQN4AvJ7PCQLIQ+SuEDsTSUslEl8w91c5VidQ/F76DaL
+FeRzccnH25EoqOI+weV1hNLVzm4yOmwuwZweVmXdApLCuWxkgUbCZyKxtYVMiWKF
+yRDhKVW3aTsnEa8vNVs7Sov+QyMYrMBDZP39ApfJ7cSR22pdo3Yj67CtEkmU3NG5
+/5udgdcq3Y2Hw6y1ghyvHpEX/+dB8HmElhdOYaUEs5A6sFYwxLGULhzrGLOpe6yd
+SslAHjF7kYdN32xoRJ40wufC48sMuS8UkoKWdjxDmZsgSfDY0XMEZmluUPD9M5bl
+KQET2CNVb10nOUFwSdDYFWvBL9Cn1yznpoOYwVA2cgMqVHpj7aWDf9ObpEn+N5K0
+TPb7LhqUo+20gJmCWOhvUgAfrWxpIusoQcNPbQ1gprNfVWvqNwlZCIrePgXceOyu
+17DViwB31NcpY8rSsAL3IfjVoqco6ekpmnz743ZJm0NKEg+NWgSplpWD8Szv22Nh
+w68ybG/iOtklQPLDK4Q32IXa0vC4xQM8AVt3pTXVrDwta//KBpR6HmUbraWnGH0m
+ko7th+czmAbAEtOMU6U/IjlMYYZtTtzoWDosusZAFirVEkg6tujuQhYQNXtw1em/
+x0VA/ZN4cDwAgxRxT+13RfkZZxGQQOguZtUFXWtFi7rh0GQMdLcEqelt3mGB8lD8
+0iFpLBMzBR/Eyyev/JW51myEr1Xx6Gz3PZkWIhG7ciIKr/El3FsWN30TwVRE5NNC
+xtKwFqhNMmAjLnw966v279Yhxua1vWYkizHxZ8gZg6bk3+V+6khQhkU/gID/YMDn
+k4DOTOGGkv0jKymz1n6dFrr+ZVyBkJ5N53wvSdDSAQComaTKTr3/FKMYsp5MrIp1
+ozDI1H2D1dyW2zl6nnabJHiiyWuD1Pi5gGNQ/oKDvNjgnNob7prRQH6T9UMhmQKG
+HFwi/JpV8syCw1Igzj4tPFmxWyVsXhjBMT8Abu/OCRF/IY1ypSH7JWmgFcbsunEV
+wk4W3+7cFnDgPNaYo59EXl6RZTKTBwOvv+eSUVvKKy0e3CBe/y2FCOjG3avnkFfM
+jbXKqLFRmXIRabfbb1mgMUSBjoIj2qvIuaSFyAs+NHz9IzwJCk89vPQeyysQdeoL
+zddTZPiEUWx/qULD/dloZdow4aK1hKv4ibV0jdI1VkdEpM56YSB6LZ54rd1BZVYi
+u9GxQ7gPAxcFb79MzD4jr7JsxlnGqxkxCXf7Q1cXCRQh3tr92SH+qa/0HA1PPWcG
+VHLloxkS3Fl734db1MVONsCMRpZkoZPEBC3e8jF5oktW0QauhGIABti4AuXbtm61
+mrDx2glNCQKAXL2W5hRp6XNb6NgUuxrrGQt8lidvbceT/e402TBvBNpUuHMl6atc
+hl5v2notQKfIu+y08soUgV0hhxVraKW+bbaaA55rsiQpv9P05759jCHmU/YwJVA9
+lWDiMnwEmXwFQ5tfVK0mag1EgmXpA7kd9gc7Lkx1RXdxsCeYNjn2lixagKzLCuO6
+J+GxBh+ZQ/dM8z0L4eD4HLmLmdTI1KLBANRmq66Em5kiEbQ74EhYTgSU1Cg6pTUH
+G7fWspvxqJVHz55vzM0XWBMRL6zvGpf056BH34AWZWROYDrUAEIpvL7rSW09/Oum
+MU3EwlKrVu7Znd4KCqX27LyemIUubRS2hBSbKaHkdfBb9C1w9DARmqug/PQl23mB
+MqaHVSopv1qIW698P0rh9wf5ZshyMdSx40MQBeqy3D+cO02ki3FZdCISJrtOwv+L
+XFsa41qg21Emnqk+06hDXYjeDxRp7zLpZpO0p8FtnQ2W
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/artifacts/testdata/files/keys/pkcs8_unencryped.pem b/artifacts/testdata/files/keys/pkcs8_unencryped.pem
@@ -0,0 +1,40 @@
+-----BEGIN PRIVATE KEY-----
+MIIG/QIBADANBgkqhkiG9w0BAQEFAASCBucwggbjAgEAAoIBgQDjft5BcTVUOXKX
+9hAMEZsIWUKhvNWP2owXBt7KM+Xf5+eBVtP3VHi/kNno3//GK7hEcVwu9nhVAZ/t
+GG7qYJSrulNTznqJRT2sQQ7bNYtHjt9zrsQ8Yut7UKFiaDHDCzzhN5PgmKcNBZ04
+Fj/es4RJGI6l7G2fsKUeSPMX94QlTZXq0ExIQXNpnI5kh36XnUlG0iciHknPtJIl
+XMi6M5VHQijjSf1wDDRerEqwHlsRfm01Pu5oMWnE16YV6ZkplJLsSWzrKc26nNjh
+mm6UwzKb+5uhUQLU9g9ztQzBcjEFofp3GDb2FJF1U5O1TDzDRvGfeDNC/pCde/Z+
+qS+UkmWkO1VywS7LEXfFTZ+NEDcOXbL2Yswr9qc7mhIQH2p4F6wpGafyAZRg9uuc
+VkZOE6xzaCSj3CoCdL/bsM8yRhQiFZDG+ybwFXBMpjMP4Zt26uGfWNQsZZMqZLFw
+fjqnEFqweQmfOx7YIKzaTDyT0m5lDkVHvF+62NNpaKOgmXbrL/8CAwEAAQKCAYAP
+cKzlBCn6bWu5pJmyN/+tsWE0WPylps+bQHwefSc86yBrRtlcD/+iANLJW2qgqJb5
+DjiTd2bzXgjcrqvYfHWasiq1pW3roydsaX34osmxMaE42MO41X3mALLzWt8Fvd2D
+66G9vJ6Z46eoBtqO4uA3ldMYr9NA41xRkeHt3n65iWqDZV/IB6ktodKIQCn3YFV4
+2QqO5j9cOYUxw/pbqOSY0YS06HCrCikDw+3NxkGoDkybMIo9yBzFn11GX3Rlvg+Z
+6yggXUfdUXXhSZm+fJWTYT6f8r3SATZUyVyA5O5FQEEQMIs/s9Y9hNHRmjruNIeX
+m3avqysnFfaYLqi0SzNPIfSZB94seCm2gVTaK3q29yj4bY6LI2dvzH4nJ0gt3FP0
+bJGwa0h0pBA/oKfepQVaMBf3an0MEj53UfA9gdEbqLjRqM4i/t4wnbrNhOGVHZu9
+eHIFHc8LLNBCY4nSe2eQIWySR1OPCB9+18qcAQJzaNeoiv7s/535znoxym0fqAEC
+gcEA/uy7iA5kI/i7SXOQg6bOxcStLppGrbz42H6Q3UsL3CR8JHPeMi0uP5URgTFA
+f7EuAqSxPIKAL35D24t72MHlWiZ9JA4s9RjLd/DLVJHm15DsdZjr/N2PcYQL86dM
+trdo1dDzCXGwTONwxZgiPo/3lOG82RQZEAGvZjR7HLcEJb1K/n014/H/Qf5pRsX4
+Zs0LM1/litmiHgaSwfrzYNy+oYoMWXz1UkwMINjvVoczsoy+eHMScRo+GYOF4JFt
+DXIfAoHBAOR0hIXJ5yL/GNT1bUGNbCBpdqrOzkwc+45Wo9GnMXfZN2QLvveGWtgZ
+tlK4pw8gexY0S/l8XLtHgBivJcAxrNElNK6sJX/3ZXjtq/YsE0vfMkSOigsSf6mh
+MS6S3BP+jAe+Oa+kj10GTmzKmfir/pV2oHQUPbEb5Yx75LEQ+987d9VKYo4nDon4
+Kr/q4gb0WXez5ZAPYrfi/KfZIwOZP07gcgJLo6G0e30sxadx/pY652uuKsGKYh9L
+Gg0eM6VGIQKBwQDGJkLaTb1fDI6fWFmjS3x70xV+HOMFVtbiiPaXXCb61c09FGdI
+/z9sorU5g4wL9S+7VEKDszhqMi4Sr8fzQzvAKByrcu1VEhHNx/h0YvhY5Mg33EbK
+hXljFe2oVYlWmRe+4yyWUa1lBoD4xfkQQh2CtzhwT6Pvgi/RNMfhGQz7PLjXOYIz
+DT6JEHTKU0VyuryTEV494E6YIine5+5Xgx4WOFTDFlMlxgDDY3wd+PehOK8wttlF
+2s0cTdQ5KzDl+6cCgcADod6hie5E3i105VoRWsBHW6XpXVRmXWeagcIlCTV+JFP/
+ITiuEtLK8M23TvxI/0k1tysmElYfHCnrOo2tGp0WzjKiPFZ0TGiunYjIZzb/U9Mm
+x+Vl+6tP9SIlDWy2XKu5S8r7AfDNl9YTYL1F+OYZVkOC1PeOI1VpAGdIcW6vw/BJ
+0d7zR6exheKYHpHtbmElyBR0T+pP5ioCOS+XVQ5uoJ7vbmhxn77+5IFYAjX8CX+4
+dJJ1dU/OE5Gcd8h2bkECgcAFkq5SJOBcvJfFZn/YwEVRzsrz6xXUmhnNjm9Czzuy
+Zcd/IXU5Slda7t1i3vAY6YAjzetUbPvqhAy4MtYbafzGzJ7zxzq45BTR4ua9H+lD
+nw9r9HSfQTD6IuoUlX+4IXaHOpIlVLiHQf2ZUDmFMpz58mLsQGwmg9PXMxaM4g4u
+9miEw29WB+jV4Iqrgm5fS61LHjxPfaF7vUhBczPiEwjfhlChv5Td1Xsun0Ekt3RE
+8g9l8/DbYtnu9I4DGY1qSsg=
+-----END PRIVATE KEY-----
diff --git a/artifacts/testdata/files/keys/unencrypted.key.pem b/artifacts/testdata/files/keys/unencrypted.key.pem
@@ -0,0 +1,38 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
+NhAAAAAwEAAQAAAYEArhxVuODKCIYyTt/UPmIuwhg6ZCkp+cJXufYlqhYkRo4cI7wzFAnf
+t5DXYK+56gYYTevZ0Vlh0MG18seOXh9i2WqM5EOcO8bzw88xc2buO04HnpMJNTIl+7pggw
+iwqAtAxjbborVC8DdLFrzaK2v11Zx5e0QOCFjnzzKnmo3ZdJVuw1r5co2ayKHyIA8VgQkW
+pxGkW7Ea8IFlUzGFCzGwEJEdwSO8KiXBeuwLPnIjJcs/gbRTQslTGLadGOrGb4K2d4a6WC
+mwgwfY00R78jOsWtSTPqjZNggKMICSner0vIQPW8/tfucp0OdQyrpZ0a1HGt1p97Bc5RvL
+AMoA13SrOu95niDOOM0zcLIjxvZ9eScygpmRcFjpuJqzIBPev2UIrC3AdlowknpFulfLUo
+lcBabWvc//ZgG1H2BZh9Q+d6E7img2X05y52mAixUYMiujURm4w4dwH8y4eVWWfDTWulbC
+Z88bgAn3B+jO2fRL4B+h5FSL9aq2YNgd3qk0p9g7AAAFgBB/4wcQf+MHAAAAB3NzaC1yc2
+EAAAGBAK4cVbjgygiGMk7f1D5iLsIYOmQpKfnCV7n2JaoWJEaOHCO8MxQJ37eQ12CvueoG
+GE3r2dFZYdDBtfLHjl4fYtlqjORDnDvG88PPMXNm7jtOB56TCTUyJfu6YIMIsKgLQMY226
+K1QvA3Sxa82itr9dWceXtEDghY588yp5qN2XSVbsNa+XKNmsih8iAPFYEJFqcRpFuxGvCB
+ZVMxhQsxsBCRHcEjvColwXrsCz5yIyXLP4G0U0LJUxi2nRjqxm+CtneGulgpsIMH2NNEe/
+IzrFrUkz6o2TYICjCAkp3q9LyED1vP7X7nKdDnUMq6WdGtRxrdafewXOUbywDKANd0qzrv
+eZ4gzjjNM3CyI8b2fXknMoKZkXBY6biasyAT3r9lCKwtwHZaMJJ6RbpXy1KJXAWm1r3P/2
+YBtR9gWYfUPnehO4poNl9OcudpgIsVGDIro1EZuMOHcB/MuHlVlnw01rpWwmfPG4AJ9wfo
+ztn0S+AfoeRUi/WqtmDYHd6pNKfYOwAAAAMBAAEAAAGAM2rWveRUhbPrw3NCYLHqERPKmq
+21YbbM5XQVp2cmi1eIY90+UFqiILm7gSgkBUKLhudxyetVgarTKsFX/9/Q91gKB5cX2mdk
+sZzMg8IP9J+UjHXrsDQBF5fwzIGSee3o0SB+OEzDWeFaYXqgC1a0oMK29XohksF+o6fX60
+Kcx1sh/LsvE29SGJIKyQDrXtHqSKhjG1jwFbqAy9LB8Y5Y6muQl+sPtHq16rEumOBoFM8z
+EADK3dxKl+/F8QfUVjYJZAsAQZx7yubEsZgYSGgJ3Rj9onIH7jMxYrZ0LN5BVUPA3Uu8kp
+OHbAiu/x2KceyCjMoCZDMHRJCLNvyNA2M3BVQ7Y8SVXWK51o605I1NE3mn+cnu63loiENY
+4dl/1v3xdnTYVqTcnmJNIfLqWkttx2tnoKZ32XP24pg+0UB+m7MvDsnsP1yQw5KAAy3A/Y
+chwid/yVpw0x5K5cX57n6GVoO3oyMa0cdPDMbaSEID/SdpFt5X1zQkXMztByQp7V+BAAAA
+wHMQKoSdgIj/3+qt5HHlBoPZdhgS7Inco/eq8thR3oAmi4WuuDycWVaOlG/kvE7hjaVCNI
+svcG6mwLq/OeYRccDn3UiWUN4OBKhtqBPKProNjZP9ZDexKCQ/XyLCTkQ5b640cXSIo6eZ
+008Oj7Fg05PhQc4MjsKvzpBaHBpsh5oMRm6pjEoKnZwmGV0jIajmwXgqkb1lY9AyDDzAeD
+EF7YA6R/oGzX28PDwSE1JFCGkz+TukEa/ioUbItrnGBb4BRQAAAMEA1VV468CLGywm8oT2
+JcuOLe7JiG9muPI2SDNOKu+YqQnch5AFlCU2OOBlN13oC2JB4XR7RYn/uJpY8aPwvey5Ea
+1W28pNCt2LibmrEgh7SUrCUf7j3iveYBV8NPJoDhodbAXRtKFCPqI279qK3RhnxRBPQY8U
+HIPZK2inqNhkIpaqsPIrV83aHeTe3DADOwK2/JWdl9gh8uGwLA30rZV60cpqaN4Zly8SET
+7GrE+SWm6DSYaTC+KanWa0ZuYThGThAAAAwQDQ7qppyC2xr2pXGFT7usISgt1tiCu4Rokz
+g5fXtv+mhf7bzsMJC/HaiD4W/dKUH2rK0qD/D4pxXoCJNnb0n7/j9R4GFpNapJ1iAM/bjP
+p6er/Fs+7DPqLvLiM/OXZDRXabhpOFoN39FmrZaLFS8o263xR8rPPb/78H5jdXLPRIDgw7
+x4ke7iSmcv3vJ+dXSze1WWjNotfMKMbn0Lkbd3sp8WXYwf+Yq3oc3aFw3D/XtW2sZ4E2cm
+2Z5Hb8NDwTRJsAAAAKbWljQGRldmJveAE=
+-----END OPENSSH PRIVATE KEY-----
diff --git a/artifacts/testdata/server/testcases/ssh.in.yaml b/artifacts/testdata/server/testcases/ssh.in.yaml
@@ -0,0 +1,4 @@
+Queries:
+  - SELECT basename(path=FullPath) AS Name, KeyType, Cipher, Header
+    FROM Artifact.Linux.Ssh.PrivateKeys(
+        KeyGlobs=srcDir+"/artifacts/testdata/files/**/*.pem")