| name | T1556.003_pluggable-authentication-modules |
| description | Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. |
| category | authentication |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1556.003","credential-access","defense-evasion","persistence","linux","macos","sub-technique"] |
| technique_id | T1556.003 |
| tactic | credential-access |
| all_tactics | ["credential-access","defense-evasion","persistence"] |
| platforms | ["Linux","macOS"] |
| mitre_url | https://attack.mitre.org/techniques/T1556/003 |
| tech_stack | ["linux","macos"] |
| cwe_ids | ["CWE-522"] |
| chains_with | ["T1556","T1556.001","T1556.002","T1556.004","T1556.005","T1556.006","T1556.007","T1556.008","T1556.009"] |
| prerequisites | ["T1556"] |
| severity_boost | {"T1556":"Chain with T1556 for deeper attack path","T1556.001":"Chain with T1556.001 for deeper attack path","T1556.002":"Chain with T1556.002 for deeper attack path"} |
T1556.003 Pluggable Authentication Modules
Sub-technique of: T1556
High-Level Description
Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is pam_unix.so, which retrieves, sets, and verifies account authentication information in /etc/passwd and /etc/shadow.
Adversaries may modify components of the PAM system to create backdoors. PAM components, such as pam_unix.so, can be patched to accept arbitrary adversary supplied values as legitimate credentials.
Malicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.
Kill Chain Phase
- Credential Access (TA0006)
- Defense Evasion (TA0005)
- Persistence (TA0003)
Platforms: Linux, macOS
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Malicious PAM rule
Inserts a rule into a PAM config and then tests it.
Upon successful execution, this test will insert a rule that allows every user to su to root without a password.
Supported Platforms: linux
Elevation Required: Yes
sudo sed -i "#{index}s,^,#{pam_rule}\n,g"
