ShadowRayC0045 ↗
During ShadowRay, threat actors used cat /etc/shadow to steal password hashes.1
tfMITRE ATT&CK sub-technique
/etc/passwd and /etc/shadow T1003.008
sub-technique of T1003 OS Credential Dumping
- Tactic
- Credential Access
- Platform
- Linux
- Version
- 1.2
- Created
- 11 February 2020
- Last modified
- 24 October 2025
Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information, including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user.[1]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.1
Tools & malware44th pct
Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.3
Detection rules54th pct
Detection rules54th percentile · 54% of ATT&CK techniques have this many detection rules written or fewer./etc/passwd and /etc/shadow MITRE reference T1003.008
72nd pctamong all ATT&CK techniques for number of campaigns
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
All 1 campaigns for this technique
Offense vs defense T1003.008
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 0Splunk ESCU (cumulative) · 3
first rule: 2022 Q1 · 1 of 1 campaigns plotted/etc/passwd and /etc/shadow detection strategy DET0446
MITRE names one behaviour worth catching for this technique and breaks it into 1 analytic, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Credential Access via /etc/passwd and /etc/shadow Parsing
1 platform
AN1234 · Linux
Adversaries attempt to read sensitive files such as /etc/passwd and /etc/shadow for credential dumping. This may involve access to the files directly via command-line utilities (e.g., cat, less), creation of backup copies, or parsing through post-exploitation frameworks. Multi-event correlation includes elevated process execution, file access/read on sensitive paths, and anomalous read behaviors tied to non-root or unusual users.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Process CreationDC0032 | auditd:SYSCALL | execve |
| File AccessDC0055 | auditd:SYSCALL | open, read |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| exe | Executable name used to access credentials (e.g., cat, cp, awk); can vary across environments |
| user | User context under which the access occurs; typically root, but can be non-standard in attacks |
| PATH | Target file paths (e.g., /etc/passwd, /etc/shadow); may vary in containerized or customized systems |
| TimeWindow | Time correlation threshold for chaining access and execution events |
Password PoliciesM1027
Ensure that root accounts have complex, unique passwords across all systems on the network.
Follow best practices in restricting access to privileged accounts to avoid hostile programs from accessing such sensitive information.
Tests5Executorssh 4 · bash 1Need elevation4 of 5Have prerequisites0Have cleanup5Platformslinux
Tests from Atomic Red Team (MIT licence) · technique definition