{"id":"fa4aaed5-4fe0-498d-bbc0-08e3346387ba","title":"Copy Passwd Or Shadow From TMP Path","description":"Detects when the file \"passwd\" or \"shadow\" is copied from tmp path","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"high","date":"2023-01-31","modified":"","tags":["attack.credential-access","attack.t1552.001"],"technique_ids":["T1552.001"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://blogs.blackberry.com/","https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144"],"source_path":"rules/linux/process_creation/proc_creation_lnx_cp_passwd_or_shadow_tmp.yml","source_sha256":"fdf0a32b9104b4261a2be24e633c0a758095b0831da02cb0b0c927caa7776aff","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_cp_passwd_or_shadow_tmp.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Copy Passwd Or Shadow From TMP Path\nid: fa4aaed5-4fe0-498d-bbc0-08e3346387ba\nstatus: test\ndescription: Detects when the file \"passwd\" or \"shadow\" is copied from tmp path\nreferences:\n    - https://blogs.blackberry.com/\n    - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-01-31\ntags:\n    - attack.credential-access\n    - attack.t1552.001\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection_img:\n        Image|endswith: '/cp'\n    selection_path:\n        CommandLine|contains: '/tmp/'\n    selection_file:\n        CommandLine|contains:\n            - 'passwd'\n            - 'shadow'\n    condition: all of selection_*\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1552.001","id":"T1552.001","name":"Credentials In Files","page":"techniques/enterprise/T1552.001/"}],"data_path":"data/detection-rules/fa4aaed5-4fe0-498d-bbc0-08e3346387ba.json","kind":"sigma"}