Credentials In Files - Linux

 1title: Credentials In Files - Linux
 2id: df3fcaea-2715-4214-99c5-0056ea59eb35
 3status: test
 4description: 'Detecting attempts to extract passwords with grep'
 5references:
 6    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
 7author: 'Igor Fits, oscd.community'
 8date: 2020/10/15
 9modified: 2023/04/30
10tags:
11    - attack.credential_access
12    - attack.t1552.001
13logsource:
14    product: linux
15    service: auditd
16detection:
17    selection:
18        type: 'EXECVE'
19    keywords:
20        '|all':
21            - 'grep'
22            - 'password'
23    condition: selection and keywords
24falsepositives:
25    - Unknown
26level: high

References

• atomic-red-team/atomics/T1552.001/T1552.001.md at f339e7da7d05f6057fdfcdd3742bfcf365fee2a9 · redcanaryco/atomic-red-team

  

  Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team

  
  Read More

Related rules

• Automated Collection Command Prompt
• Extracting Information with PowerShell
• Suspicious Unattend.xml File Access
• Credentials In Files
• Process Memory Dump via RdrLeakDiag.EXE