Non-system process loads libpam and validates creds before network exfil

Duo Tech@duotech

•updated Jul 6, 2026•3•0•4

This rule detects processes that load Pluggable Authentication Modules (PAM) libraries (libpam) and subsequently initiate network connections within a 30-minute window. This behavior is often associated with credential dumping tools or malicious implants attempting to exfiltrate cached credentials or session information from memory on Linux and macOS systems.