Velvet Ant PAM/OpenSSH Binary Integrity Deviation on Auth Stack

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects the use of package management or file integrity monitoring tools (rpm, dpkg, debsums, aide, inotifywait) to verify or interact with critical SSH/PAM configuration files, or the use of inotifywait to monitor SSH configuration access. This behavior may indicate an adversary attempting to verify compromised configurations, check for the presence of backdoors, or monitor security modifications.