Repository navigation

Add Linux Auditd PAM Configuration File Modification detection - #4381

Open

vahidmalekk wants to merge 2 commits into

splunk:developfrom

vahidmalekk:detection/linux-auditd-pam-modification

Open

Add Linux Auditd PAM Configuration File Modification detection#4381
vahidmalekk wants to merge 2 commits into
splunk:developfrom
vahidmalekk:detection/linux-auditd-pam-modification

Commits on Oct 31, 2026
- Add Linux Auditd PAM Configuration File Modification detection
  vahidmalekk
  committed
  c8dbc43
Commits on Nov 2, 2026
- Rework PAM modification: CWD path reconstruction, success guard, drop syscall-name filter (address review)
  vahidmalekk
  committed
  189e045