Suspicious Modification of PAM Configuration

yasser djehaf@cifer

•updated Jan 24, 2026•1•0•42

Detects attempts to modify Pluggable Authentication Modules (PAM) configuration files. Attackers may modify PAM configurations to bypass authentication, such as by adding `pam_permit.so` or changing module control flags from `required` to `sufficient` or `optional`.