Potential SSH Authorized Key Overwrite [splunk-edr]

`get_endpoint_data` `get_endpoint_data_edr` ((TERM(vi) 
OR TERM(vim) 
OR TERM(nano) 
OR ((TERM(echo) 
OR TERM(cat)) 
AND TERM(>)) 
OR TERM(visudo) 
OR TERM(CP) 
OR TERM(MV)) (".ssh/authorized_keys" 
OR "authorized_keys")) 
OR (TERM(cd) ".ssh")
| regex process="(?i)(vi
| visudo
| vim
| nano
| (echo
| cat)\s+.*?>>?
| cp
| mv
| cd)\s.*?(authorized_keys
| \.ssh)"
| table _time, host, user, process, process_*
| bin span=1s
| stats values(*) as * by _time, host `hec_collect`