Linux PAM-based Backdoor Detection (Plague)
This rule detects the presence or execution of files identified by specific SHA256 hashes or file names associated with PAM-based backdoors on Linux systems. It monitors device events, file events, process events, and image load events for these indicators. The rule aims to identify the 'Plague' PAM-based backdoor or similar malicious PAM modules.
Microsoft Sentinel (KQL)
