Velvet Ant - sshd/PAM Writing Credentials to Non-Standard Paths

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects potential credential harvesting activities targeting the SSH and PAM authentication stacks. The rule identifies suspicious file operations (creation/modification/read) by authentication-related processes (sshd, login, su, sudo) involving sensitive files like /etc/shadow or non-standard file paths in temporary directories, as well as the spawning of interpreters that write to these suspicious locations.