T1556.003 — Pluggable Authentication Modules

Tactics: Defense Impairment, Persistence, Credential Access · Platforms: Linux, macOS

Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication…

Sub-technique of Modify Authentication Process (T1556).

Sigma detection rules (2)

T1556.003 Modify Authentication Process: Pluggable Authentication Modules

title: "T1556.003 Modify Authentication Process: Pluggable Authentication Modules"
id: eb061253-6153-4ff0-9f83-50dd6b17b891
description: 'Detect Malicious Modification of Pluggable Authentication Modules (PAM). (Retargeted to the file_change auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredPaths, TimeWindow, BaselineAccounts.'
references:
  - https://attack.mitre.org/techniques/T1556/003
author: Shahrukh Khan
date: 2026-03-16
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.003

logsource:
  category: file_change
  product: linux

detection:
  selection:
    type: PATH
    nametype: NORMAL
    name|contains:
      - '/etc/pam.d/sshd'
      - '/etc/pam.d/login'
      - '/etc/security/google_authenticator'
      - '/etc/pam.d/common-auth'

  condition: selection

falsepositives:
  - Legitimate MFA rollout/rotation by admins during a scheduled maintenance window (tune BaselineAccounts/TimeWindow) modifies the same files.

level: high

T1556.003 Modify Authentication Process: Pluggable Authentication Modules

title: "T1556.003 Modify Authentication Process: Pluggable Authentication Modules"
id: d2d90805-0bf4-4eca-b3af-3aecaa0fda8e
description: 'Detect Malicious Modification of Pluggable Authentication Modules (PAM). (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: WatchedPlugins, CorrelatedSources.'
references:
  - https://attack.mitre.org/techniques/T1556/003
author: Shahrukh Khan
date: 2026-02-26
license: MIT
tags:
  - attack.defense-impairment
  - attack.persistence
  - attack.credential-access
  - attack.t1556.003

logsource:
  category: file_change
  product: macos

detection:
  selection:
    TargetFilename|contains: '/etc/pam.d/'
    TargetFilename|endswith:
      - 'sudo'
      - 'login'
      - 'authorization'

  condition: selection

falsepositives:
  - System updates or admin-approved MDM configuration profiles rewriting PAM service files.

level: high

Related sub-techniques

Explore