Linux: Unauthorized use of OpenSSL for password hash generation

The OpenSSL command-line utility provides functionality for cryptographic operations, including the generation of password hashes via the 'passwd' subcommand. Attackers frequently leverage this capability during post-exploitation to manipulate local accounts, such as creating new privileged users or resetting passwords for existing accounts to ensure continued access to the target host.

Impact

Successful exploitation allows for persistent unauthorized access to the Linux system. This facilitates account manipulation (T1098) and local account creation (T1136.001), potentially enabling attackers to bypass standard authentication controls or establish backdoors.

Recommendation

Deploy process-creation monitoring to capture 'openssl' executions. Baseline all administrative scripts and service accounts that legitimately use 'openssl passwd' for provisioning or system maintenance to reduce noise. Investigate any instances where this command is executed by non-administrative users or from unexpected parent processes.