Velvet Ant PAM Backdoor: Hardcoded Master Password SSH Auth Bypass

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

This rule detects successful SSH sessions initiated on Linux systems that are immediately followed by the creation of new executable or script files in common temporary directories such as /tmp, /dev/shm, or /var/tmp. This behavior is indicative of potential post-exploitation activity where an attacker drops tools or malicious scripts after gaining remote access.