Detect Pluggable Authentication Modules in CrowdStrike LogScale
Adversaries may modify Pluggable Authentication Modules (PAM) to access user credentials or create backdoors. PAM is a modular authentication framework used by Linux and macOS services. The primary module pam_unix.so handles authentication against /etc/passwd and /etc/shadow. Adversaries patch pam_unix.so to accept a hardcoded backdoor password for any account, or harvest plaintext credentials during authentication. Skidmap malware replaced pam_unix.so with a malicious version accepting a specific backdoor password.
MITRE ATT&CK
- Technique
- T1556 Modify Authentication Process
- Sub-technique
- T1556.003 Pluggable Authentication Modules
- Canonical reference
- https://attack.mitre.org/techniques/T1556/003/
LogScale Detection Query
#event_simpleName = /WriteFile|PeFileWritten/
| FilePath = /\/(lib\/security|lib64\/security|usr\/lib\/security|usr\/lib64\/security|lib\/x86_64-linux-gnu\/security|lib\/aarch64-linux-gnu\/security|etc\/pam\.d|etc\/pam\.conf)/
| not ImageFileName = /\/(apt|apt-get|dpkg|rpm|yum|dnf|zypper|pacman|pip|pip3|ldconfig|update-alternatives)$/
| groupBy(
[ComputerName, aid, UserName, FilePath, FileName, ImageFileName, CommandLine],
function=[
count(as=event_count),
min(field=@timestamp, as=first_seen),
max(field=@timestamp, as=last_seen)
]
)
| sort(field=event_count, order=desc)CrowdStrike LogScale (Falcon) query detecting PAM library and PAM configuration file write events from non-package-manager processes on Linux endpoints. Uses WriteFile and PeFileWritten Falcon event types with regex path matching against all common pam_unix.so library directories and /etc/pam.d/. Groups results by host, user, file path, and initiating executable to surface repeated or bulk modification patterns.
Data Sources
Required Tables
False Positives & Tuning
- Package managers installing or upgrading libpam libraries — excluded by ImageFileName filter for direct invocations, but postinstall maintainer scripts running under sh, bash, or perl will bypass the process name check and require secondary validation against the parent process chain
- The pam-auth-update tool invoked interactively by a system administrator to toggle PAM module features — this generates multiple rapid /etc/pam.d/ writes that appear as a burst in the grouped event_count output and should be correlated with an active admin SSH session on the same aid
- CIS Benchmark or DISA STIG remediation automation tools (OpenSCAP, ansible-hardening role) that rewrite PAM configuration files to enforce lockout thresholds and password complexity rules — validate against scheduled compliance enforcement windows in your change management system
Other platforms for T1556.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Check PAM Module Integrity
Expected signal: Auditd syscall events for file opens on PAM module paths. Syslog entries if auditd is configured with watches on /lib/security/. Process creation events for rpm or dpkg.
- Test 2Add Permissive PAM Configuration Entry (Non-Destructive)
Expected signal: Auditd file write events for the PAM configuration file modification. Sysmon (Linux) Event ID 11 equivalent for file creation. Process creation events for cp and echo commands.
- Test 3Monitor PAM Authentication Events for Anomalies
Expected signal: Linux syslog entries in /var/log/secure or /var/log/auth.log showing 'pam_unix(su:auth): authentication failure' for the nonexistent user. Auditd USER_AUTH events.
References (6)
- https://attack.mitre.org/techniques/T1556/003/
- https://github.com/zephrax/linux-pam-backdoor
- https://web.archive.org/web/20240303094335/https://x-c3ll.github.io/posts/PAM-backdoor-DNS/
- https://linux.die.net/man/8/pam_unix
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.003/T1556.003.md
- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/managing_smart_cards/pluggable_authentication_modules
Unlock Pro Content
Get the full detection package for T1556.003 including response playbook, investigation guide, and atomic red team tests.