Full Report
The Group-IB DFIR Team has identified a new technique not yet included in the MITRE ATT&CK framework, which could lead to use the module pam_exec to obtain a privileged shell on a host and grant a full persistence to a threat actor.
Analysis Summary
# Tool/Technique: PAM_EXEC Persistence & Privilege Escalation
## Overview
This technique leverages the `pam_exec` module within the Linux Pluggable Authentication Modules (PAM) framework. By modifying PAM configuration files, a threat actor can trigger the execution of arbitrary scripts or binaries during authentication events (like SSH logins). This allows for stealthy persistence, privilege escalation to a root shell, and data exfiltration that bypasses traditional system logging.
## Technical Details
- **Type:** Technique (Post-Exploitation / Persistence)
- **Platform:** Linux / Unix-based systems
- **Capabilities:** Persistence, Privilege Escalation, Stealthy Data Exfiltration, Credential Harvesting.
- **First Seen:** Reported by Group-IB DFIR Team in 2024.
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- **[T1543.004 - Create or Modify System Process: SSH Daemon]** (Related)
- **[T1556 - Modify Authentication Process]** (New sub-technique proposed: PAM Modification)
- **[TA0004 - Privilege Escalation]**
- **[T1548 - Abuse Elevation Control Mechanism]**
- **[TA0010 - Exfiltration]**
- **[T1041 - Exfiltration Over C2 Channel]**
## Functionality
### Core Capabilities
- **Automated Execution:** Triggers malicious scripts whenever a user attempts to authenticate via SSH, console, or sudo.
- **Privileged Access:** Because PAM often runs with root privileges, the executed `pam_exec` script can grant a full privileged shell to the attacker.
- **Persistence:** Even if the attacker's initial entry point is closed, the modified PAM configuration ensures they regain access upon the next authentication event.
### Advanced Features
- **Log Evasion:** The technique can be configured to exfiltrate data or establish a reverse shell even if the login attempt fails. Standard SSH logs (`/var/log/auth.log`) will only show a "Failed password" or "Connection closed" message, hiding the script execution.
- **Environment Variable Manipulation:** Use of specific PAM environment variables to pass authentication data directly to malicious scripts.
## Indicators of Compromise
- **File Names:**
- Check for unusual scripts in `/usr/local/bin/`, `/tmp/`, or hidden directories being called by PAM.
- Configuration changes in `/etc/pam.d/common-auth`, `/etc/pam.d/sshd`, or `/etc/pam.d/system-auth`.
- **Registry Keys:** N/A (Linux-based).
- **Network Indicators:**
- Unexpected outbound connections to unknown IP addresses (e.g., `[attacker_ip]`) originating from the SSH process or shell scripts.
- **Behavioral Indicators:**
- Unauthorized modifications to files in `/etc/pam.d/`.
- The presence of the directive `auth optional pam_exec.so /path/to/script.sh` in PAM configs.
- Unusual shell activity immediately following a failed SSH login attempt.
## Associated Threat Actors
- While specific named groups were not linked in this initial discovery, this technique is characteristic of sophisticated actors seeking long-term, stealthy persistence on critical Linux infrastructure.
## Detection Methods
- **Signature-based:** Scanning `/etc/pam.d/` files for the string `pam_exec.so` combined with non-standard script paths.
- **Behavioral detection:** Monitoring for child processes spawned by the PAM process or SSH daemon that are not part of the standard login flow.
- **Auditd:** Use `auditd` to monitor write access to `/etc/pam.d/` and execution of suspicious scripts.
- *Rule example:* `-w /etc/pam.d/ -p wa -k pam_modification`
- **File Integrity Monitoring (FIM):** Using tools like AIDE or Samhain to detect unauthorized changes to PAM configuration files.
## Mitigation Strategies
- **Hardening:**
- Restrict write permissions to `/etc/pam.d/` to only the absolute necessary administrative accounts.
- Implement **SELinux** or **AppArmor** in enforcing mode to restrict what processes spawned by PAM can do.
- **Prevention:**
- Disable root login via SSH (`PermitRootLogin no` in `sshd_config`).
- Use Multi-Factor Authentication (MFA), which adds layers beyond simple PAM checks.
- **Monitoring:** Deploy **Auditd** with DISA-STIG rules to ensure all administrative actions and configuration changes are logged externally.
## Related Tools/Techniques
- **PAM Backdoors:** Traditional PAM backdoors involved replacing `pam_unix.so` with a malicious version; this technique is stealthier as it uses a legitimate, built-in module (`pam_exec.so`).
- **SSH Authorized_keys modification:** A more common but more easily detected persistence method.