Velvet Ant PAM Module Tampering - pam_unix.so and /etc/pam.d Modification

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

This rule detects unauthorized modifications or creations of files within critical Linux Pluggable Authentication Module (PAM) directories (such as /etc/pam.d/ and /lib/security/). Attackers often target these files to implement backdoors, bypass authentication mechanisms, or harvest credentials. The rule excludes common package management tools to minimize false positives.