TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Black Hills InfoSec

The “P” in PAM is for Persistence: Linux Persistence Technique

BHIS · 2026-03-04 · Read original ↗

ATT&CK techniques detected

4 predictions
T1556.003Pluggable Authentication Modules
87%
“the “ p ” in pam is for persistence : linux persistence technique the “ p ” in pam is for persistence : linux persistence technique ben bowman is a security analyst at black hills information security. he graduated in 2024 with a degree in cyber operations. ben conducts research …”
T1556.003Pluggable Authentication Modules
83%
“if we did this, we would be able to bypass the user ’ s password with our own, even if the user changes their password. furthermore, we could even capture the user ’ s password pre - encryption and exfiltrate it for later use. pam skeleton key steps i took an old tool and revampe…”
T1556.003Pluggable Authentication Modules
72%
“reliable target when attacking them. when authenticating via ssh, sshd initiates a request to the pluggable authentication modules library rather than handling the credentials itself. pam is the framework used in linux and unix systems to manage how applications authenticate user…”
T1556.003Pluggable Authentication Modules
45%
“null > ~ /. bash _ history & & history - c " at this point, the tool was ready to use ; i cleared the bash history to cover my tracks. 2. creating the backdoor password i ran the following command to create the universal password “ skeleton ” and a webhook to my discord server. "…”

Summary

Linux Persistence For Pentesters

Learn about a pentesting tool using the Pluggable Authentication Module for privilege escalation, lateral movement, and persistence in Linux.

The post The “P” in PAM is for Persistence: Linux Persistence Technique appeared first on Black Hills Information Security, Inc..