So many of the successful logins are just a set of commands intended to add new SSH keys to ~/.ssh/authorized_keys. Many of them actually follow up with a key-based login attempt, but we don't support keys, so they fail. Allow actors to authenticate to certain accounts with keys (as well as with passwords) to capture the follow-up to this sort of activity. Make sure to log the key info, too, which could be helpful for campaign tracking.