Detection of Unauthorized Access to Linux Credential Files

Adversaries targeting Linux environments frequently attempt to retrieve sensitive credential information to enable lateral movement, persistence, or privilege escalation. A primary method for achieving this is the extraction of user account details and password hashes from system files located at /etc/passwd and /etc/shadow. This detection identifies anomalous activity where standard command-line utilities and text editors, specifically 'cat', 'nano', 'vim', and 'vi', are utilized to read these sensitive files. This behavior is a strong indicator of post-compromise activity, as legitimate system administration tasks involving these specific tools and file paths are often scripted or restricted to specialized security maintenance windows. Detection engineers should correlate this activity with other anomalous signals, such as unexpected remote access or suspicious lateral movement attempts, to validate malicious intent.

Attack Chain

1. Attacker gains initial access to the Linux endpoint via exploitation or stolen credentials.
2. Attacker performs local reconnaissance to identify target files in /etc/.
3. Attacker uses native binaries like 'cat' or editors like 'vim'/'vi' to interact with /etc/passwd or /etc/shadow.
4. System auditd logs the process execution and the associated command-line arguments.
5. Security platform ingests the auditd proctitle event.
6. Detection logic triggers based on the matching process name and sensitive target file.
7. Adversary exfiltrates the contents of these files to an external command-and-control server.
8. Adversary performs offline password cracking to escalate privileges to root or pivot to other systems.

Impact

Successful unauthorized access to /etc/passwd and /etc/shadow allows adversaries to obtain user account information and hashed passwords. Offline cracking of these hashes can lead to full system compromise, escalation to root-level privileges, and facilitate lateral movement throughout the target network. This technique is observed across multiple adversary groups and is a fundamental component of the post-compromise phase in Linux-based cyberattacks.

Recommendation

• Deploy the Sigma rule provided in this brief to identify attempts to read sensitive credential files.
• Integrate Linux Auditd logs into the SIEM, specifically focusing on SYSCALL, TYPE, EXECVE, and PROCTITLE events.
• Implement process-level monitoring for unauthorized access to /etc/passwd and /etc/shadow, and tune the detection based on known administrative baselines.
• Use the provided drilldown searches in your SOC platform to review historical risk events associated with the affected destination host.