Velvet Ant: FIM Violation on Linux PAM Modules or OpenSSH Binaries

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

This rule detects modifications (such as write, rename, create, or delete events) to critical Linux system files including SSH binaries (sshd, ssh, scp) and PAM authentication modules (pam_unix.so). These files are common targets for adversaries seeking to establish persistence, bypass authentication mechanisms, or gain unauthorized access to credentials.