ATT&CK technique
View on MITRE ATT&CK →
T1556.003
Pluggable Authentication Modules
Defense ImpairmentPersistenceCredential Access
5 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Pluggable Authentication Module or Configuration Creation | production | 2026-09-18 |
| elastic | Pluggable Authentication Module (PAM) Creation in Unusual Directory | production | 2026-09-18 |
| elastic | Potential Backdoor Execution Through PAM_EXEC | production | 2026-09-18 |
| elastic | Pluggable Authentication Module (PAM) Source Download | production | 2026-09-18 |
| elastic | Authentication via Unusual PAM Grantor | production | 2026-09-18 |