LoFP LoFP / administrative work

Techniques

Sample rules

Linux Keylogging with Pam.d

Description

Detect attempt to enable auditing of TTY input

Detection logic

condition: 1 of selection_*
selection_path_events:
  name:
  - /etc/pam.d/system-auth
  - /etc/pam.d/password-auth
  type: PATH
selection_tty_events:
  type:
  - TTY
  - USER_TTY