Velvet Ant - Backdoored PAM pam_unix.so Credential Harvesting to /tmp

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule monitors Linux authentication logs for anomalies related to Pluggable Authentication Modules (PAM). It identifies potential security risks by detecting file operations (read, write, create) within PAM-related processes, references to world-writable or temporary directories that may be used for staging credentials, and unusual authentication event patterns.