Techniques › T1003.007 › AN1631
AN1631 Analytic 1631
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Monitoring adversary access to sensitive process memory via the /proc filesystem to extract credential material, often involving multi-step access to /proc/[pid]/mem or /proc/[pid]/maps combined with privilege escalation or credential scraping binaries.</p>
- Detects
- T1003.007 Proc Filesystem
- Part of
- DET0593 Detecting OS Credential Dumping via /proc Filesystem Access on Linux
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | open, read | DC0055 File Access |
| auditd:SYSCALL | write | DC0061 File Modification |
| auditd:SYSCALL | ptrace or process_vm_readv | DC0035 Process Access |
| linux:Sysmon | EventCode=1 | DC0032 Process Creation |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
AccessedFilePath | Monitored paths such as /proc/[pid]/mem or /proc/[pid]/maps may need to be scoped based on environment |
ProcessName | Command-line or binary names associated with credential scraping tools may vary |
UserContext | Elevated user or unexpected user context accessing other process memory may indicate malicious activity |
TimeWindow | Correlating memory access with process creation or ptrace activity within a specific time range |