[rule]
description = """
Identifies the execution of the unshadow utility which is part of John the Ripper, a password-cracking tool on the host
machine. Malicious actors can use the utility to retrieve the combined contents of the '/etc/shadow' and '/etc/password'
files. Using the combined file generated from the utility, the malicious threat actors can use them as input for
password-cracking utilities or prepare themselves for future operations by gathering credential information of the
victim.
"""
id = "05f95917-6942-4aab-a904-37c6db906503"
license = "Elastic License v2"
name = "Potential Linux Credential Dumping via Unshadow"
os_list = ["linux"]
reference = ["https://www.cyberciti.biz/faq/unix-linux-password-cracking-john-the-ripper/"]
version = "1.0.9"
query = '''
process where event.type == "start" and event.action == "exec" and
process.name == "unshadow" and process.args_count >= 2
'''
min_endpoint_version = "8.5.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1003"
name = "OS Credential Dumping"
reference = "https://attack.mitre.org/techniques/T1003/"
[[threat.technique.subtechnique]]
id = "T1003.008"
name = "/etc/passwd and /etc/shadow"
reference = "https://attack.mitre.org/techniques/T1003/008/"
[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"
[internal]
min_endpoint_version = "8.5.0"