Linux Keylogging with Pam.d — Detection Rule

Detect attempt to enable auditing of TTY input

Read the full analysis on IntelFusions