T1556.003 Pluggable Authentication Modules — Attack Simulation

Technique description

Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is pam_unix.so, which retrieves, sets, and verifies account authentication information in /etc/passwd and /etc/shadow. Adversaries may modify…

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

• Malicious PAM rule
  linuxautomatedsh

  Procedure 4b9dde80-ae22-44b1-a82a-644bf009eb9c; elevation required; cleanup present, not reviewed. Not executed or individually validated.

• Malicious PAM module
  linuxautomatedsh

  Procedure 65208808-3125-4a2e-8389-a0a00e9ab326; elevation required; cleanup present, not reviewed. Not executed or individually validated.

• Malicious PAM rule (freebsd)
  linuxautomatedsh

  Procedure b17eacac-282d-4ca8-a240-46602cf863e3; elevation required; cleanup present, not reviewed. Not executed or individually validated.