SkidmapS0468 ↗
Has the ability to replace the pam_unix.so file on an infected machine with its own malicious version that accepts a specific backdoor password for all users.1
tfMITRE ATT&CK sub-technique
Pluggable Authentication Modules T1556.003
sub-technique of T1556 Modify Authentication Process
- Platforms
- Linux, macOS
- Version
- 3.0
- Created
- 26 June 2020
- Last modified
- 12 May 2026
- Contributors
- George Allen, VMware Carbon Black; Scott Knight, @sdotknight, VMware Carbon Black
Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is pam_unix.so, which retrieves, sets, and verifies account authentication information in /etc/passwd and /etc/shadow.[1][2][3]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Pluggable Authentication Modules MITRE reference T1556.003
51st pctamong all ATT&CK techniques for number of tools
Offense vs defense T1556.003
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Pluggable Authentication Modules detection strategy DET0454
MITRE names one behaviour worth catching for this technique and breaks it into 2 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detect Malicious Modification of Pluggable Authentication Modules (PAM)
2 platforms
AN1250 · Linux
Detects unauthorized modifications to PAM configuration files or shared object modules. Correlates file modification events under /etc/pam.d/ or /lib/security/ with unusual authentication activity such as multiple simultaneous logins, off-hours logins, or logons without corresponding physical/VPN access.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File ModificationDC0061 | auditd:SYSCALL | open, write |
| Logon Session CreationDC0067 | NSM:Connections | simultaneous or anomalous logon sessions across multiple systems |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| MonitoredPaths | List of PAM configuration and module directories monitored (e.g., /etc/pam.d/, /lib/security/). |
| TimeWindow | Timeframe for correlating suspicious file modifications with anomalous login events. |
| BaselineAccounts | Expected login frequency and systems per user account; deviations may indicate compromise. |
AN1251 · macOS
Detects suspicious changes to macOS authorization and PAM plugin files. Correlates file modifications under /etc/pam.d/ or /Library/Security/SecurityAgentPlugins with unexpected authentication attempts or anomalous account usage.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| File ModificationDC0061 | macos:osquery | write |
| Logon Session CreationDC0067 | macos:unifiedlog | authentication plugin load or modification events |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| WatchedPlugins | Expected set of PAM and authorization plugins; unknown additions may indicate malicious insertion. |
| CorrelatedSources | Cross-correlation with VPN/physical access logs to identify impossible or anomalous login patterns. |
Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information.
Limit access to the root account and prevent users from modifying PAM components through proper privilege separation (ex SELinux, grsecurity, AppArmor, etc.) and limiting Privilege Escalation opportunities.
Tests3Executorssh 3Need elevation3 of 3Have prerequisites1Have cleanup3Platformslinux
Tests from Atomic Red Team (MIT licence) · technique definition