Velvet Ant - Trojanized PAM Module Load or Tampering on Linux Auth Stack
Detects potential tampering with Pluggable Authentication Modules (PAM) or configuration files on Linux systems. This includes the loading of non-standard shared libraries by authentication-related processes (sshd, sudo, login), modification of core PAM modules (e.g., pam_unix.so) by non-package manager processes, and unauthorized modifications to files within /etc/pam.d/. It also monitors for credential-related activity where authentication processes write data into temporary or hidden directories.
SentinelOne
