Linux Keylogging with Pam.d (49aae26c-450e-448b-911d-b3c13d178dfc)

Detect attempt to enable auditing of TTY input

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Linux Keylogging with Pam.d (49aae26c-450e-448b-911d-b3c13d178dfc)	Sigma-Rules	Keylogging - T1056.001 (09a60ea3-a8d1-4ae5-976e-5783248b72a4)	Attack Pattern	1
Linux Keylogging with Pam.d (49aae26c-450e-448b-911d-b3c13d178dfc)	Sigma-Rules	OS Credential Dumping - T1003 (0a3ead4e-6d47-4ccb-854c-a6a4f9d96b22)	Attack Pattern	1
Input Capture - T1056 (bb5a00de-e086-4859-a231-fa793f6797e2)	Attack Pattern	Keylogging - T1056.001 (09a60ea3-a8d1-4ae5-976e-5783248b72a4)	Attack Pattern	2