{"id":"T1556.003","name":"Pluggable Authentication Modules","url":"https://attack.mitre.org/techniques/T1556/003","tactics":["defense-impairment","persistence","credential-access"],"platforms":["Linux","macOS"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0454","stix_id":"x-mitre-detection-strategy--9af47d08-fbb3-4122-8af4-74105cc23b62","name":"Detect Malicious Modification of Pluggable Authentication Modules (PAM)","url":"https://attack.mitre.org/detectionstrategies/DET0454","analytics":[{"id":"AN1250","stix_id":"x-mitre-analytic--d9c7e50d-4b13-4634-80f9-e8032a043414","name":"Analytic 1250","description":"Detects unauthorized modifications to PAM configuration files or shared object modules. Correlates file modification events under /etc/pam.d/ or /lib/security/ with unusual authentication activity such as multiple simultaneous logins, off-hours logins, or logons without corresponding physical/VPN access.","url":"https://attack.mitre.org/detectionstrategies/DET0454#AN1250","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"open, write","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-syscall"},{"name":"auditd:SYSCALL","channel":"execve","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"NSM:Connections","channel":"simultaneous or anomalous logon sessions across multiple systems","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"nsm-connections"}],"mutable_elements":[{"field":"MonitoredPaths","description":"List of PAM configuration and module directories monitored (e.g., /etc/pam.d/, /lib/security/)."},{"field":"TimeWindow","description":"Timeframe for correlating suspicious file modifications with anomalous login events."},{"field":"BaselineAccounts","description":"Expected login frequency and systems per user account; deviations may indicate compromise."}],"live":true,"detection_strategies":["DET0454"],"techniques":["T1556.003"]},{"id":"AN1251","stix_id":"x-mitre-analytic--04cd1c76-d01d-482c-83e2-4bb5109e9764","name":"Analytic 1251","description":"Detects suspicious changes to macOS authorization and PAM plugin files. Correlates file modifications under /etc/pam.d/ or /Library/Security/SecurityAgentPlugins with unexpected authentication attempts or anomalous account usage.","url":"https://attack.mitre.org/detectionstrategies/DET0454#AN1251","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"authentication plugin load or modification events","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"macos-unifiedlog"},{"name":"macos:osquery","channel":"write","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"macos-osquery"}],"mutable_elements":[{"field":"WatchedPlugins","description":"Expected set of PAM and authorization plugins; unknown additions may indicate malicious insertion."},{"field":"CorrelatedSources","description":"Cross-correlation with VPN/physical access logs to identify impossible or anomalous login patterns."}],"live":true,"detection_strategies":["DET0454"],"techniques":["T1556.003"]}],"live":true,"version":"1.0","techniques":["T1556.003"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}