Modify Authentication Process: Pluggable Authentication Modules
- ID
- T1556.003
- Tactics
- TA0003 Persistence, TA0006 Credential Access, TA0112 Defense Impairment
- Sub-technique of
- T1556 Modify Authentication Process
- Platforms
- Linux, macOS
- Data sources
- File Modification, Process Creation, Logon Session Creation
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is pam_unix.so, which retrieves, sets, and verifies account authentication information in /etc/passwd and /etc/shadow.[1][2][3]
Adversaries may modify components of the PAM system to create backdoors. PAM components, such as pam_unix.so, can be patched to accept arbitrary adversary supplied values as legitimate credentials.[4]
Malicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.[5][1]
Detection
- DET0454 Detect Malicious Modification of Pluggable Authentication Modules (PAM)
Data components: File Modification, Process Creation, Logon Session Creation
Mitigations (2)
- M1026 Privileged Account Management
Limit access to the root account and prevent users from modifying PAM components through proper privilege separation (ex SELinux, grsecurity, AppArmor, etc.) and limiting Privilege Escalation opportunities.
- M1032 Multi-factor Authentication
Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information.