Cross-source coverage
T1556.003 / ATT&CK
Modify Authentication Process: Pluggable Authentication Modules
10 rules across 2 sources.
From MITRE ATT&CK 19.2
Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is pam_unix.so, which retrieves, sets, and verifies account authentication information in /etc/passwd and /etc/shadow.
Adversaries may modify components of the PAM system to create backdoors. PAM components, such as pam_unix.so, can be patched to accept arbitrary adversary supplied values as legitimate credentials.
Malicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.
- Tactics
- Defense Impairment · Persistence · Credential Access
- Platforms
- Linux · macOS
- Telemetry
-
auditd:SYSCALLNSM:Connectionsmacos:unifiedlogmacos:osquery
How MITRE says to detect it DET0454
Detect Malicious Modification of Pluggable Authentication Modules (PAM)
Linux Analytic 1250
Detects unauthorized modifications to PAM configuration files or shared object modules. Correlates file modification events under /etc/pam.d/ or /lib/security/ with unusual authentication activity such as multiple simultaneous logins, off-hours logins, or logons without corresponding physical/VPN access.
auditd:SYSCALLopen, writeauditd:SYSCALLexecveNSM:Connectionssimultaneous or anomalous logon sessions across multiple systems
macOS Analytic 1251
Detects suspicious changes to macOS authorization and PAM plugin files. Correlates file modifications under /etc/pam.d/ or /Library/Security/SecurityAgentPlugins with unexpected authentication attempts or anomalous account usage.
macos:unifiedlogauthentication plugin load or modification eventsmacos:osquerywrite
elastic/detection-rules
5 rules| Detection | Severity | Format |
|---|---|---|
| Authentication via Unusual PAM Grantor | Medium | Elastic TOML |
| Pluggable Authentication Module or Configuration Creation | Medium | Elastic TOML |
| Pluggable Authentication Module (PAM) Source Download | Medium | Elastic TOML |
| Potential Backdoor Execution Through PAM_EXEC | Medium | Elastic TOML |
| Pluggable Authentication Module (PAM) Creation in Unusual Directory | Low | Elastic TOML |
socfortress/Wazuh-Rules
5 rules| Detection | Severity | Format |
|---|---|---|
| Possible compilation of custom PAM module (T1556.003) | High | Wazuh XML |
| Possible PAM backdoor rule inserted (T1556.003) | High | Wazuh XML |
| Suspicious PAM module path used from temp directory (T1556.003) | High | Wazuh XML |
| Use of pam_succeed_if.so may indicate PAM rule bypass attempt (T1556.003) | High | Wazuh XML |
| Write to PAM configuration file (T1556.003) | Medium | Wazuh XML |