Velvet Ant Operation Highland malicious NSS plugin deployment on Linux

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule monitors for modifications to critical Name Service Switch (NSS) configuration files (/etc/nsswitch.conf) or the creation/loading of NSS shared library files (/lib/libnss_*.so). Adversaries may target these files to manipulate identity management, gain persistence, or escalate privileges by intercepting authentication requests.