Techniques › T1003.008 › AN1234
AN1234 Analytic 1234
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Adversaries attempt to read sensitive files such as /etc/passwd and /etc/shadow for credential dumping. This may involve access to the files directly via command-line utilities (e.g., cat, less), creation of backup copies, or parsing through post-exploitation frameworks. Multi-event correlation includes elevated process execution, file access/read on sensitive paths, and anomalous read behaviors tied to non-root or unusual users.</p>
- Detects
- T1003.008 /etc/passwd and /etc/shadow
- Part of
- DET0446 Credential Access via /etc/passwd and /etc/shadow Parsing
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | open, read | DC0055 File Access |
| auditd:SYSCALL | execve | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
exe | Executable name used to access credentials (e.g., cat, cp, awk); can vary across environments |
user | User context under which the access occurs; typically root, but can be non-standard in attacks |
PATH | Target file paths (e.g., /etc/passwd, /etc/shadow); may vary in containerized or customized systems |
TimeWindow | Time correlation threshold for chaining access and execution events |
KEV CVEs whose mapped technique this analytic detects
| CVE | Vendor / product | State |
|---|---|---|
| CVE-2024-24919 | Check Point Quantum Security Gateways | Mapped |