{"id":"49aae26c-450e-448b-911d-b3c13d178dfc","title":"Linux Keylogging with Pam.d","description":"Detect attempt to enable auditing of TTY input","author":"Pawel Mazur","status":"test","level":"high","date":"2021-05-24","modified":"2022-12-18","tags":["attack.collection","attack.credential-access","attack.t1003","attack.t1056.001"],"technique_ids":["T1003","T1056.001"],"logsource":{"product":"linux","service":"auditd"},"falsepositives":["Administrative work"],"references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/T1056.001.md","https://linux.die.net/man/8/pam_tty_audit","https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sec-configuring_pam_for_auditing","https://access.redhat.com/articles/4409591#audit-record-types-2"],"source_path":"rules/linux/auditd/lnx_auditd_keylogging_with_pam_d.yml","source_sha256":"6d8c21170ae1127d0332decff157db704c6664c96eee4cb956dc3a6d33696eb8","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/lnx_auditd_keylogging_with_pam_d.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Linux Keylogging with Pam.d\nid: 49aae26c-450e-448b-911d-b3c13d178dfc\nstatus: test\ndescription: Detect attempt to enable auditing of TTY input\nreferences:\n    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1056.001/T1056.001.md\n    - https://linux.die.net/man/8/pam_tty_audit\n    - https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/html/security_guide/sec-configuring_pam_for_auditing\n    - https://access.redhat.com/articles/4409591#audit-record-types-2\nauthor: 'Pawel Mazur'\ndate: 2021-05-24\nmodified: 2022-12-18\ntags:\n    - attack.collection\n    - attack.credential-access\n    - attack.t1003\n    - attack.t1056.001\nlogsource:\n    product: linux\n    service: auditd\ndetection:\n    selection_path_events:\n        type: PATH\n        name:\n            - '/etc/pam.d/system-auth'\n            - '/etc/pam.d/password-auth'\n    selection_tty_events:\n        type:\n            - 'TTY'\n            - 'USER_TTY'\n    condition: 1 of selection_*\nfalsepositives:\n    - Administrative work\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1003","id":"T1003","name":"OS Credential Dumping","page":"techniques/enterprise/T1003/"},{"key":"enterprise/T1056.001","id":"T1056.001","name":"Keylogging","page":"techniques/enterprise/T1056.001/"}],"data_path":"data/detection-rules/49aae26c-450e-448b-911d-b3c13d178dfc.json","kind":"sigma"}