Elastic medium stable kql

Authentication via Unusual PAM Grantor

This rule detects successful authentications via PAM grantors that are not commonly used. This could indicate an attacker is attempting to escalate privileges or maintain persistence on the system by modifying the default PAM configuration.

View Source

Detection Logic

event.category:authentication and host.os.type:linux and event.action:authenticated and event.outcome:success and
auditd.data.grantors:(* and not (pam_rootok or *pam_cap* or *pam_permit*))

Field Validations

Loading…

Comments (0)

Loading comments...