Trojanized sshd/PAM Credential Log File Write to /tmp or /var

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where the sshd process or PAM-related processes create or write to files within temporary directories (/tmp/ or /var/). This behavior is often associated with the staging of malicious scripts, backdoors, or tools during an attack involving credential abuse or unauthorized access via SSH.