Cross-source coverage
T1003.008 / ATT&CK
OS Credential Dumping: /etc/passwd and /etc/shadow
From MITRE ATT&CK 19.2
Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information, including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user.
Linux stores user information such as user ID, group ID, home directory path, and login shell in /etc/passwd. A "user" on the system may belong to a person or a service. All password hashes are stored in /etc/shadow - including entries for users with no passwords and users with locked or disabled accounts.
Adversaries may attempt to read or dump the /etc/passwd and /etc/shadow files on Linux systems via command line utilities such as the cat command. Additionally, the Linux utility unshadow can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper - for example, via the command /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db. Since the user information stored in /etc/passwd are linked to the password hashes in /etc/shadow, an adversary would need to have access to both.
- Tactics
- Credential Access
- Platforms
- Linux
- Telemetry
-
auditd:SYSCALL
How MITRE says to detect it DET0446
Credential Access via /etc/passwd and /etc/shadow Parsing
Linux Analytic 1234
Adversaries attempt to read sensitive files such as /etc/passwd and /etc/shadow for credential dumping. This may involve access to the files directly via command-line utilities (e.g., cat, less), creation of backup copies, or parsing through post-exploitation frameworks. Multi-event correlation includes elevated process execution, file access/read on sensitive paths, and anomalous read behaviors tied to non-root or unusual users.
auditd:SYSCALLopen, readauditd:SYSCALLexecve
elastic/detection-rules
10 rules| Detection | Severity | Format |
|---|---|---|
| Dumping Account Hashes via Built-In Commands | High | Elastic TOML |
| Potential Linux Credential Dumping via Unshadow | High | Elastic TOML |
| Suspicious Execution from Foomatic-rip or Cupsd Parent | High | Elastic TOML |
| Potential Shadow File Read via Command Line Utilities | Medium | Elastic TOML |
| Potential Unauthorized Access via Wildcard Injection Detected | Medium | Elastic TOML |
| Potential Privilege Escalation via Linux DAC permissions | Low | Elastic TOML |
| Potential Suspicious File Edit | Low | Elastic TOML |
| Suspicious Execution via Windows Subsystem for Linux | Low | Elastic TOML |
| Suspicious Symbolic Link Created | Low | Elastic TOML |
| Web Server Potential Command Injection Request | Low | Elastic TOML |
elastic/protections-artifacts
4 rules| Detection | Severity | Format |
|---|---|---|
| Potential Linux Credential Dumping via Mimipenguin | Undefined | Elastic TOML |
| Potential Linux Credential Dumping via Proc Filesystem | Undefined | Elastic TOML |
| Potential Linux Credential Dumping via Unshadow | Undefined | Elastic TOML |
| Potential Shadow Read via Unprivileged User | Undefined | Elastic TOML |
splunk/security_content
3 rules| Detection | Severity | Format |
|---|---|---|
| ESXi Sensitive Files Accessed | Undefined | SPL |
| Linux Auditd Possible Access To Credential Files | Undefined | SPL |
| Linux Possible Access To Credential Files | Undefined | SPL |