T1556.003 Pluggable Authentication Modules Detection — KQL & SPL Queries for Sentinel and Splunk

Microsoft Sentinel / Defender

kusto

let PAMFilePaths = dynamic([
  "/lib/security/pam_unix.so", "/lib64/security/pam_unix.so",
  "/usr/lib/security/pam_unix.so", "/usr/lib64/security/pam_unix.so",
  "/lib/x86_64-linux-gnu/security/pam_unix.so",
  "/lib/aarch64-linux-gnu/security/pam_unix.so",
  "/etc/pam.d/", "/etc/pam.conf"
]);
DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath has_any ("/lib/security", "/lib64/security", "/usr/lib/security",
                             "/lib/x86_64-linux-gnu/security", "/etc/pam.d", "/etc/pam.conf")
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where InitiatingProcessFileName !in~ ("apt", "apt-get", "dpkg", "rpm", "yum", "dnf", "zypper", "pacman", "pip", "pip3")
| project Timestamp, DeviceName, FolderPath, FileName, ActionType,
          InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessAccountName, SHA256
| sort by Timestamp desc

critical severity high confidence

Data Sources

File: File Modification File: File Creation Microsoft Defender for Endpoint (Linux)

Required Tables

DeviceFileEvents

False Positives

Package manager updates (apt, yum, rpm, dnf) replacing PAM modules during OS or software upgrades
Configuration management tools (Ansible, Chef, Puppet, Salt) deploying updated PAM configurations via authorized playbooks
Security hardening scripts legitimately modifying /etc/pam.d/ to enforce password policies or MFA
System administrators manually patching PAM modules after a vulnerability disclosure

Splunk

spl

index=linux_secure OR index=syslog sourcetype="linux_secure"
  ("pam_unix" OR "pam_succeed_if" OR "pam_ldap")
  ("authentication failure" OR "check pass" OR "user unknown")
| eval AuthResult=case(
    match(_raw, "authentication failure"), "FAILURE",
    match(_raw, "Accepted password"), "SUCCESS",
    match(_raw, "user unknown"), "UNKNOWN_USER",
    1==1, "OTHER"
  )
| stats count as Events, dc(src) as UniqueSources, values(AuthResult) as Results by user, host
| where Events > 20 AND UniqueSources > 1
| sort - Events
| append
  [search index=syslog sourcetype="syslog"
   ("pam_unix" OR "pam_deny" OR "pam_warn")
   ("session opened" OR "session closed")
   NOT user IN ("root", "daemon", "nobody")
  | rex field=_raw "pam_unix\\((?<service>[^:]+):(?<pamtype>[^)]+)\\)"
  | table _time, host, user, service, pamtype, _raw]

high severity medium confidence

Data Sources

Authentication: Authentication Logs Linux /var/log/secure Linux /var/log/auth.log

Required Sourcetypes

linux_secure

False Positives

Legitimate high-volume authentication from service accounts or automated processes
SSH brute-force attempts generating many pam_unix authentication failures (adjust threshold per environment)
Users with typo-prone passwords generating clusters of failures before success
SSSD or LDAP authentication failures during domain connectivity issues

Elastic Security (EQL)

eql

file where event.type in ("creation", "change", "rename") and
  (
    file.path : (
      "/lib/security/pam_unix.so",
      "/lib64/security/pam_unix.so",
      "/usr/lib/security/pam_unix.so",
      "/usr/lib64/security/pam_unix.so",
      "/lib/x86_64-linux-gnu/security/pam_unix.so",
      "/lib/aarch64-linux-gnu/security/pam_unix.so"
    ) or
    file.path : "/etc/pam.d/*" or
    file.path : "/etc/pam.conf"
  ) and
  not process.name in (
    "apt", "apt-get", "dpkg", "rpm", "yum", "dnf",
    "zypper", "pacman", "pip", "pip3", "make",
    "install", "ldconfig", "update-alternatives"
  )

high severity high confidence

Data Sources

Elastic Endpoint Security agent Auditbeat with auditd module enabled Filebeat with system module (file integrity monitoring)

Required Tables

logs-endpoint.events.file-* auditbeat-* filebeat-*

False Positives

Legitimate OS package updates deploying a new version of libpam — the process.name exclusion filter covers direct package manager invocations but may miss postinstall scripts spawned as child processes with names like ldconfig or update-alternatives
Configuration management tools such as Ansible, Puppet, or Chef applying a security hardening baseline that writes new /etc/pam.d/ entries for MFA (e.g., pam_google_authenticator) or password complexity policy enforcement
Security administrators manually editing /etc/pam.d/sshd or /etc/pam.d/sudo to enable TOTP or hardware key (FIDO2/YubiKey) authentication — correlate with change management tickets and admin session logs

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(devicetime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
  LOGSOURCENAME(logsourceid) AS log_source,
  LOGSOURCETYPENAME(devicetype) AS log_source_type,
  CATEGORYNAME(category) AS event_category,
  QIDNAME(qid) AS event_name,
  username,
  sourceip,
  "Process Name" AS process_name,
  "File Path" AS file_path,
  "File Name" AS file_name,
  "Command" AS command_line
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (11, 105, 352)
  AND (
    "File Path" ILIKE '/lib/security%'
    OR "File Path" ILIKE '/lib64/security%'
    OR "File Path" ILIKE '/usr/lib/security%'
    OR "File Path" ILIKE '/usr/lib64/security%'
    OR "File Path" ILIKE '/lib/x86_64-linux-gnu/security%'
    OR "File Path" ILIKE '/lib/aarch64-linux-gnu/security%'
    OR "File Path" ILIKE '/etc/pam.d/%'
    OR "File Path" = '/etc/pam.conf'
  )
  AND CATEGORYNAME(category) ILIKE '%file%'
  AND (
    "Process Name" IS NULL
    OR "Process Name" NOT IN (
      'apt', 'apt-get', 'dpkg', 'rpm', 'yum', 'dnf',
      'zypper', 'pacman', 'pip', 'pip3', 'ldconfig'
    )
  )
  AND devicetime > NOW() - 86400000
ORDER BY devicetime DESC
LIMIT 500

high severity medium confidence

Data Sources

Linux Auditd DSM (LOGSOURCETYPEID 105) Linux OS Syslog DSM (LOGSOURCETYPEID 11) Universal CEF DSM (LOGSOURCETYPEID 352) for endpoint agents

Required Tables

events

False Positives

OS package manager operations installing or upgrading libpam packages — the process filter handles direct invocations but postinstall maintainer scripts may run under interpreter names such as sh or bash, bypassing the process name exclusion
SSSD or realmd joining a Linux host to an Active Directory domain, which writes /etc/pam.d/system-auth and /etc/pam.d/password-auth to enable Kerberos and SSSD modules — these are expected during domain enrollment windows
Cloud-init or vendor provisioning agents (AWS SSM Agent, Azure VM extension) that configure PAM during first-boot to enforce organization-wide authentication policies before the host is registered in asset inventory

Sumo Logic CSE

sql

_sourceCategory=linux/auditd OR _sourceCategory=linux/syslog
| parse regex "(?i)type=(?:PATH|SYSCALL|CREATE|MODIFY|WRITE)" nodrop
| parse regex field=_raw "name=\"(?<file_path>[^\"]+)\"" nodrop
| parse regex field=_raw "exe=\"(?<process_exe>[^\"]+)\"" nodrop
| parse regex field=_raw "comm=\"(?<process_name>[^\"]+)\"" nodrop
| parse regex field=_raw "hostname=(?<src_host>\S+)" nodrop
| parse regex field=_raw "auid=(?<auid>\d+)" nodrop
| where (
    file_path matches "/lib/security/pam_unix.so" or
    file_path matches "/lib64/security/pam_unix.so" or
    file_path matches "/usr/lib/security/pam_unix.so" or
    file_path matches "/usr/lib64/security/pam_unix.so" or
    file_path matches "/lib/x86_64-linux-gnu/security/pam_unix.so" or
    file_path matches "/lib/aarch64-linux-gnu/security/pam_unix.so" or
    file_path matches "/etc/pam.d/*" or
    file_path = "/etc/pam.conf"
  )
| where !(
    process_name in ("apt", "apt-get", "dpkg", "rpm", "yum", "dnf",
                     "zypper", "pacman", "pip", "pip3", "ldconfig")
    or process_exe matches "*/apt*"
    or process_exe matches "*/dpkg*"
    or process_exe matches "*/rpm*"
  )
| count as event_count by _sourceHost, file_path, process_name, process_exe, auid
| sort by event_count desc

high severity high confidence

Data Sources

Linux Auditd (auditd daemon forwarded via syslog or Sumo Logic collector) Linux Syslog

Required Tables

_sourceCategory=linux/auditd _sourceCategory=linux/syslog

False Positives

Automated configuration management systems (Ansible, SaltStack, Chef) applying a security hardening run that modifies PAM configuration files — the auid field can help distinguish human (interactive) sessions from automation (auid=4294967295 for unattended processes)
The pam-auth-update utility run interactively by an administrator to enable or disable PAM feature modules — this generates a burst of /etc/pam.d/ writes in rapid succession that looks anomalous in aggregate count
OpenSCAP or CIS-CAT remediation scripts automatically rewriting PAM configuration files to enforce DISA STIG or CIS Benchmark password complexity and lockout policies — validate against scheduled compliance scan windows

Google Chronicle / SecOps

yaral

rule pam_module_modification {
  meta:
    author = "Detection Engineering"
    description = "Detects unauthorized creation, modification, or renaming of PAM shared library modules and configuration files. Indicative of T1556.003 backdoor installation tactics used by Skidmap and similar malware that replace pam_unix.so to accept a hardcoded backdoor password for any account."
    mitre_attack_tactic = "Credential Access"
    mitre_attack_technique = "T1556.003"
    mitre_attack_technique_name = "Pluggable Authentication Modules"
    severity = "HIGH"
    priority = "HIGH"
    version = "1.0"
    created = "2025-01-01"

  events:
    (
      $e.metadata.event_type = "FILE_MODIFICATION" or
      $e.metadata.event_type = "FILE_CREATION" or
      $e.metadata.event_type = "FILE_MOVE"
    )
    (
      re.regex($e.target.file.full_path, `/lib(64)?/security/pam_unix\.so`) or
      re.regex($e.target.file.full_path, `/usr/lib(64)?/security/pam_unix\.so`) or
      re.regex($e.target.file.full_path,
        `/lib/(x86_64|aarch64|armhf|arm64)-linux-gnu/security/pam_unix\.so`) or
      re.regex($e.target.file.full_path, `/etc/pam\.d/`) or
      $e.target.file.full_path = "/etc/pam.conf"
    )
    not re.regex($e.principal.process.file.full_path,
      `/(apt|apt-get|dpkg|rpm|yum|dnf|zypper|pacman|pip3?|ldconfig|update-alternatives)$`)

  condition:
    $e
}

critical severity high confidence

Data Sources

Google Chronicle UDM (Universal Data Model) Linux endpoint telemetry ingested via Chronicle forwarder Auditd logs normalized to Chronicle UDM by Chronicle parsers

Required Tables

UDM Events — FILE_MODIFICATION, FILE_CREATION, FILE_MOVE event types

False Positives

Distribution package manager upgrades of libpam that install a new pam_unix.so — excluded when the package manager binary is the direct initiating process, but postinstall ldconfig or update-alternatives calls may match if their parent is not captured in the process chain
Containerized workloads building Docker images that COPY a custom PAM configuration into a Linux base image during docker build — these appear as file creation events but occur within ephemeral build namespaces and may not represent host-level compromise
Puppet or Chef client runs applying an initial PAM configuration baseline to a freshly provisioned host before it enters the production asset inventory — correlate $e.principal.hostname against provisioning pipeline records for the same timestamp window

CrowdStrike LogScale (CQL)

cql

#event_simpleName = /WriteFile|PeFileWritten/
| FilePath = /\/(lib\/security|lib64\/security|usr\/lib\/security|usr\/lib64\/security|lib\/x86_64-linux-gnu\/security|lib\/aarch64-linux-gnu\/security|etc\/pam\.d|etc\/pam\.conf)/
| not ImageFileName = /\/(apt|apt-get|dpkg|rpm|yum|dnf|zypper|pacman|pip|pip3|ldconfig|update-alternatives)$/
| groupBy(
    [ComputerName, aid, UserName, FilePath, FileName, ImageFileName, CommandLine],
    function=[
      count(as=event_count),
      min(field=@timestamp, as=first_seen),
      max(field=@timestamp, as=last_seen)
    ]
  )
| sort(field=event_count, order=desc)

high severity medium confidence

Data Sources

CrowdStrike Falcon Endpoint Protection (Linux sensor) Falcon Insight XDR with file write telemetry enabled

Required Tables

#event_simpleName=WriteFile #event_simpleName=PeFileWritten

False Positives

Package managers installing or upgrading libpam libraries — excluded by ImageFileName filter for direct invocations, but postinstall maintainer scripts running under sh, bash, or perl will bypass the process name check and require secondary validation against the parent process chain
The pam-auth-update tool invoked interactively by a system administrator to toggle PAM module features — this generates multiple rapid /etc/pam.d/ writes that appear as a burst in the grouped event_count output and should be correlated with an active admin SSH session on the same aid
CIS Benchmark or DISA STIG remediation automation tools (OpenSCAP, ansible-hardening role) that rewrite PAM configuration files to enforce lockout thresholds and password complexity rules — validate against scheduled compliance enforcement windows in your change management system

Pluggable Authentication Modules

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Same Tactic: Credential Access

Popular Detections