AN1250
Analytic 1250
Linux
Detects unauthorized modifications to PAM configuration files or shared object modules. Correlates file modification events under /etc/pam.d/ or /lib/security/ with unusual authentication activity such as multiple simultaneous logins, off-hours logins, or logons without corresponding physical/VPN access.
auditd:SYSCALL
open, write
auditd:SYSCALL
execve
NSM:Connections
simultaneous or anomalous logon sessions across multiple systems
[MonitoredPaths]
List of PAM configuration and module directories monitored (e.g., /etc/pam.d/, /lib/security/).
[TimeWindow]
Timeframe for correlating suspicious file modifications with anomalous login events.
[BaselineAccounts]
Expected login frequency and systems per user account; deviations may indicate compromise.
AN1251
Analytic 1251
macOS
Detects suspicious changes to macOS authorization and PAM plugin files. Correlates file modifications under /etc/pam.d/ or /Library/Security/SecurityAgentPlugins with unexpected authentication attempts or anomalous account usage.
macos:unifiedlog
authentication plugin load or modification events
macos:osquery
write
[WatchedPlugins]
Expected set of PAM and authorization plugins; unknown additions may indicate malicious insertion.
[CorrelatedSources]
Cross-correlation with VPN/physical access logs to identify impossible or anomalous login patterns.