MITRE ATT&CKsub-technique

T1556.003 Pluggable Authentication Modules

Published 2020-06-26 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Defense Impairment, Persistence, Credential Access
Platforms
Linux, macOS
Version
3.0
Created
2020-06-26

Description

Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts. PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services. The most common authentication module is pam_unix.so, which retrieves, sets, and verifies account authentication information in /etc/passwd and /etc/shadow. Adversaries may modify components of the PAM system to create backdoors. PAM components, such as pam_unix.so, can be patched to accept arbitrary adversary supplied values as legitimate credentials. Malicious modifications to the PAM system may also be abused to steal credentials. Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1556 Modify Authentication Process technique

Tactic · MITRE ATT&CK (3)

  • TA0112 Defense Impairment tactic
  • TA0003 Persistence tactic
  • TA0006 Credential Access tactic

Referenced by MITRE ATT&CK · mitigates (2)

  • M1032 Multi-factor Authentication mitigation
  • M1026 Privileged Account Management mitigation

Referenced by MITRE ATT&CK · uses (2)

  • S0468 Skidmap software (malware)
  • S0377 Ebury software (malware)

Referenced by Compliance · mitigates (13)

  • CIS-6.5 Require MFA for Administrative Access CIS Safeguard v8.1
  • NIST-AC-2 Account Management NIST 800-53 control
  • NIST-AC-20 Use of External Systems NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AC-5 Separation of Duties NIST 800-53 control
  • NIST-AC-6 Least Privilege NIST 800-53 control
  • NIST-AC-7 Unsuccessful Logon Attempts NIST 800-53 control
  • NIST-CM-5 Access Restrictions for Change NIST 800-53 control
  • NIST-CM-6 Configuration Settings NIST 800-53 control
  • NIST-IA-2 Identification and Authentication (Organizational Users) NIST 800-53 control
  • NIST-IA-5 Authenticator Management NIST 800-53 control
  • NIST-SI-4 System Monitoring NIST 800-53 control
  • NIST-SI-7 Software, Firmware, and Information Integrity NIST 800-53 control

References