Linux PAM TTY Audit for Keylogging
This rule detects attempts to enable auditing of TTY input on Linux systems by monitoring modifications to PAM (Pluggable Authentication Modules) configuration files. Specifically, it looks for changes to '/etc/pam.d/system-auth' and '/etc/pam.d/password-auth' in conjunction with TTY-related audit events. This activity could indicate an adversary attempting to implement keylogging functionality using the pam_tty_audit module to capture user input.
Sigma
