PAM Module Modified for Authentication Bypass
This rule detects network traffic containing the string "/etc/pam.d/" over TCP port 22 (SSH). This could indicate an attempt to modify Pluggable Authentication Modules (PAM) configuration files, potentially for authentication bypass or persistence on a Linux system. The detection is focused on traffic originating from the home network to the home network, suggesting internal activity or a compromised host communicating within the network.
Suricata
