/etc/passwd and /etc/shadow
Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking. Most modern Linux operating systems use a combination of <code>/etc/passwd</code> and <code>/etc/shadow</code> to store user account information, including password hashes in <code>/etc/shadow</code>. By default, <code>/etc/shadow</code> is only readable by the root user.(Citation: Linux Password and Shadow File Formats) Linux stores user information such as...
BY SOURCE
PROCEDURES (11)
Auto-extracted: 2 detections for lateral
Auto-extracted: 2 detections for dump
Auto-extracted: 1 detections for credential
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for lateral
Auto-extracted: 1 detections for persist
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for inject
Auto-extracted: 1 detections for general monitoring
Auto-extracted: 1 detections for suspicious
Auto-extracted: 1 detections for inject