Detect Pluggable Authentication Modules in Sumo Logic CSE
Adversaries may modify Pluggable Authentication Modules (PAM) to access user credentials or create backdoors. PAM is a modular authentication framework used by Linux and macOS services. The primary module pam_unix.so handles authentication against /etc/passwd and /etc/shadow. Adversaries patch pam_unix.so to accept a hardcoded backdoor password for any account, or harvest plaintext credentials during authentication. Skidmap malware replaced pam_unix.so with a malicious version accepting a specific backdoor password.
MITRE ATT&CK
- Technique
- T1556 Modify Authentication Process
- Sub-technique
- T1556.003 Pluggable Authentication Modules
- Canonical reference
- https://attack.mitre.org/techniques/T1556/003/
Sumo Detection Query
_sourceCategory=linux/auditd OR _sourceCategory=linux/syslog
| parse regex "(?i)type=(?:PATH|SYSCALL|CREATE|MODIFY|WRITE)" nodrop
| parse regex field=_raw "name=\"(?<file_path>[^\"]+)\"" nodrop
| parse regex field=_raw "exe=\"(?<process_exe>[^\"]+)\"" nodrop
| parse regex field=_raw "comm=\"(?<process_name>[^\"]+)\"" nodrop
| parse regex field=_raw "hostname=(?<src_host>\S+)" nodrop
| parse regex field=_raw "auid=(?<auid>\d+)" nodrop
| where (
file_path matches "/lib/security/pam_unix.so" or
file_path matches "/lib64/security/pam_unix.so" or
file_path matches "/usr/lib/security/pam_unix.so" or
file_path matches "/usr/lib64/security/pam_unix.so" or
file_path matches "/lib/x86_64-linux-gnu/security/pam_unix.so" or
file_path matches "/lib/aarch64-linux-gnu/security/pam_unix.so" or
file_path matches "/etc/pam.d/*" or
file_path = "/etc/pam.conf"
)
| where !(
process_name in ("apt", "apt-get", "dpkg", "rpm", "yum", "dnf",
"zypper", "pacman", "pip", "pip3", "ldconfig")
or process_exe matches "*/apt*"
or process_exe matches "*/dpkg*"
or process_exe matches "*/rpm*"
)
| count as event_count by _sourceHost, file_path, process_name, process_exe, auid
| sort by event_count descSumo Logic query parsing raw Linux auditd log records to detect PAM authentication library and configuration file modifications. Extracts file paths, process executables, and audit session IDs (auid) from auditd PATH and SYSCALL record types. Filters to target pam_unix.so across all common architecture-specific library paths and /etc/pam.d/ entries, excluding known package managers by both process name and executable path.
Data Sources
Required Tables
False Positives & Tuning
- Automated configuration management systems (Ansible, SaltStack, Chef) applying a security hardening run that modifies PAM configuration files — the auid field can help distinguish human (interactive) sessions from automation (auid=4294967295 for unattended processes)
- The pam-auth-update utility run interactively by an administrator to enable or disable PAM feature modules — this generates a burst of /etc/pam.d/ writes in rapid succession that looks anomalous in aggregate count
- OpenSCAP or CIS-CAT remediation scripts automatically rewriting PAM configuration files to enforce DISA STIG or CIS Benchmark password complexity and lockout policies — validate against scheduled compliance scan windows
Other platforms for T1556.003
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Check PAM Module Integrity
Expected signal: Auditd syscall events for file opens on PAM module paths. Syslog entries if auditd is configured with watches on /lib/security/. Process creation events for rpm or dpkg.
- Test 2Add Permissive PAM Configuration Entry (Non-Destructive)
Expected signal: Auditd file write events for the PAM configuration file modification. Sysmon (Linux) Event ID 11 equivalent for file creation. Process creation events for cp and echo commands.
- Test 3Monitor PAM Authentication Events for Anomalies
Expected signal: Linux syslog entries in /var/log/secure or /var/log/auth.log showing 'pam_unix(su:auth): authentication failure' for the nonexistent user. Auditd USER_AUTH events.
References (6)
- https://attack.mitre.org/techniques/T1556/003/
- https://github.com/zephrax/linux-pam-backdoor
- https://web.archive.org/web/20240303094335/https://x-c3ll.github.io/posts/PAM-backdoor-DNS/
- https://linux.die.net/man/8/pam_unix
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1556.003/T1556.003.md
- https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/managing_smart_cards/pluggable_authentication_modules
Unlock Pro Content
Get the full detection package for T1556.003 including response playbook, investigation guide, and atomic red team tests.