From b31bd6947cda287a902919e219b4cc3296cc9331 Mon Sep 17 00:00:00 2001
From: vahidmalekk <46035912+vahidmalekk@users.noreply.github.com>
Date: Sat, 31 Oct 2026 15:29:52 +0330
Subject: [PATCH] Add Linux auditd PAM backdoor dataset (T1556.003)

Auditd PATH+SYSCALL+PROCTITLE records captured from a reversible PAM
backdoor sim on an authorized lab host: an editor rewrite (sed -> rename,
PATH CREATE) and an in-place append (tee, PATH NORMAL) adding
'auth sufficient pam_permit.so' to /etc/pam.d/common-auth. For the
Linux Auditd PAM Configuration File Modification detection.
---
 .../linux_auditd_pam_backdoor/linux_auditd_pam_backdoor.log    | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 datasets/attack_techniques/T1556.003/linux_auditd_pam_backdoor/linux_auditd_pam_backdoor.log

diff --git a/datasets/attack_techniques/T1556.003/linux_auditd_pam_backdoor/linux_auditd_pam_backdoor.log b/datasets/attack_techniques/T1556.003/linux_auditd_pam_backdoor/linux_auditd_pam_backdoor.log
new file mode 100644
index 00000000..fd5619f7
--- /dev/null
+++ b/datasets/attack_techniques/T1556.003/linux_auditd_pam_backdoor/linux_auditd_pam_backdoor.log
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:6669405d524e34c20113d352ebb3e9266eacd9cd3a5d625d0f1c09ef97e5d3a4
+size 2541