Copy Passwd Or Shadow From TMP Path — Sigma Rule

Rule metadata and linked tags

Author: Joseliyo Sanchez, @Joseliyo_Jstnk. Source status: test; severity: high. Source dates: 2023-01-31 / not supplied.

{
  "product": "linux",
  "category": "process_creation"
}

Pinned original Sigma rule · Detection Rule License 1.1

Source SHA-256: fdf0a32b9104b4261a2be24e633c0a758095b0831da02cb0b0c927caa7776aff

Detection logic

Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.

title: Copy Passwd Or Shadow From TMP Path
id: fa4aaed5-4fe0-498d-bbc0-08e3346387ba
status: test
description: Detects when the file "passwd" or "shadow" is copied from tmp path
references:
    - https://blogs.blackberry.com/
    - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
author: Joseliyo Sanchez, @Joseliyo_Jstnk
date: 2023-01-31
tags:
    - attack.credential-access
    - attack.t1552.001
logsource:
    product: linux
    category: process_creation
detection:
    selection_img:
        Image|endswith: '/cp'
    selection_path:
        CommandLine|contains: '/tmp/'
    selection_file:
        CommandLine|contains:
            - 'passwd'
            - 'shadow'
    condition: all of selection_*
falsepositives:
    - Unknown
level: high

Original YAML and metadata in JSON

False positives

• Unknown

Source references

• https://blogs.blackberry.com/
• https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144