• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    Linux Pam Backdoor

    avatar
    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Danny Y@zendannyy
    •updated Jun 3, 2026•0•0•6

    Detects modified PAM modules or ELF files implementing PAM backdoors for credential interception, as seen in Ebury and QLNX, whihc uses Rootkit techniques.

    YARA

    Tags

    T1556.003 - Pluggable Authentication ModulesS0377 - EburyT1014 - RootkitTA0006 - Credential AccessTA0005 - Defense EvasionTA0003 - PersistenceCredential AccessMalware DetectedFile ModificationLinuxelfbackdoor

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?