Credential Harvest Artifacts Written by Backdoored Auth Process to Staging Dirs

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•7

Detects suspicious file creation activities by system authentication processes (e.g., sshd, su, sudo, PAM) in known staging directories (/tmp, /var/tmp, /dev/shm) or SSH configuration paths. The rule looks for hidden files or files with specific extensions (.log, .dat, .bak) often associated with malicious backdoored components used to intercept and store credentials in plaintext.