Velvet Ant PAM Module Tampering - pam_unix.so Replacement (T1556.003)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•2

Detects unauthorized write, modification, or rename operations within Linux Pluggable Authentication Module (PAM) directories (/lib/security, /lib64/security, /usr/lib/security, /etc/pam.d). The rule identifies activity performed by processes that are not recognized package managers (e.g., apt, yum, dpkg), which is a common technique used by threat actors to inject malicious authentication modules or backdoors (e.g., pam_unix.so replacement) to hijack authentication processes.