OS Credential Dumping: Proc Filesystem `T1003.007`

Tactic: Credential Access

Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. For each process, the `/proc/<PID>/maps` file shows how memory is mapped within the process’s virtual address space. And `/proc/<PID>/mem`, exposed for debugging purposes, provides access to the process’s virtual address space.

Authoring guide

These 9 rules share fields, values, and exclusions.

Fields filtered most (6 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`EventType`	9	`in` 5, `eq` 4	`exec`, `exec_event`, `ProcessRollup2`, `ptrace`, `start`
`process_name`	9	`eq` 6, `in` 3	`gdb`, `cat`, `egrep`, `strings`, `agetty`
`event.type`	8	`eq` 8	`start`
`process.args`	7	`in` 4, `eq` 3, `wildcard` 2, `ne` 1, `starts_with` 1	`--pid`, `-p`, `1`, `-eo`, `/dev/mem`
`host.os.type`	5	`eq` 5
`CommandLine`	1	`wildcard` 1	`/proc/*/mem`

Top indicator values (56 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.type`	`eq`	`start` elasticLinux init (PID 1) Secret Dump via GDB elasticLinux init (PID 1) Secret Dump via GDB elasticLinux Process Hooking via GDB elasticManual Memory Dumping via Proc Filesystem elasticManual Memory Password Searching Activity elasticPotential Credential Access via Ptrace elasticPotential Memory Dumping via dd elasticSuspicious /proc/maps Discovery	8	1087
`EventType`	`in`	`exec` elasticLinux init (PID 1) Secret Dump via GDB elasticLinux Process Hooking via GDB elasticManual Memory Dumping via Proc Filesystem elasticPotential Linux Credential Dumping via Proc Filesystem elasticSuspicious /proc/maps Discovery	5	206
`EventType`	`in`	`exec_event` elasticLinux init (PID 1) Secret Dump via GDB elasticLinux Process Hooking via GDB elasticManual Memory Dumping via Proc Filesystem elasticPotential Linux Credential Dumping via Proc Filesystem elasticSuspicious /proc/maps Discovery	5	150
`EventType`	`in`	`start` elasticLinux init (PID 1) Secret Dump via GDB elasticLinux Process Hooking via GDB elasticManual Memory Dumping via Proc Filesystem elasticPotential Linux Credential Dumping via Proc Filesystem elasticSuspicious /proc/maps Discovery	5	168
`EventType`	`in`	`ProcessRollup2` elasticLinux init (PID 1) Secret Dump via GDB elasticLinux Process Hooking via GDB elasticManual Memory Dumping via Proc Filesystem elasticSuspicious /proc/maps Discovery	4	118
`EventType`	`in`	`executed` elasticLinux init (PID 1) Secret Dump via GDB elasticLinux Process Hooking via GDB elasticManual Memory Dumping via Proc Filesystem elasticSuspicious /proc/maps Discovery	4	98
`EventType`	`in`	`process_started` elasticLinux init (PID 1) Secret Dump via GDB elasticLinux Process Hooking via GDB elasticManual Memory Dumping via Proc Filesystem elasticSuspicious /proc/maps Discovery	4	83
`EventType`	`eq`	`exec` elasticLinux init (PID 1) Secret Dump via GDB elasticManual Memory Password Searching Activity elasticPotential Credential Access via Ptrace elasticPotential Memory Dumping via dd	4	579
`EventType`	`eq`	`ptrace` elasticPotential Credential Access via Ptrace	1
`process.args`	`in`	`--pid` elasticLinux init (PID 1) Secret Dump via GDB elasticLinux init (PID 1) Secret Dump via GDB elasticLinux Process Hooking via GDB	3	3
`process.args`	`in`	`-p` elasticLinux init (PID 1) Secret Dump via GDB elasticLinux init (PID 1) Secret Dump via GDB elasticLinux Process Hooking via GDB	3	4
`process.args`	`in`	`-eo` elasticPotential Linux Credential Dumping via Proc Filesystem	1
`process.args`	`in`	`command` elasticPotential Linux Credential Dumping via Proc Filesystem	1
`process.args`	`in`	`pid` elasticPotential Linux Credential Dumping via Proc Filesystem	1
`process_name`	`eq`	`gdb` elasticLinux init (PID 1) Secret Dump via GDB elasticLinux init (PID 1) Secret Dump via GDB elasticLinux Process Hooking via GDB	3	6
`process_name`	`eq`	`strings` elasticManual Memory Password Searching Activity elasticPotential Linux Credential Dumping via Proc Filesystem	2	4
`process.args`	`eq`	`1` elasticLinux init (PID 1) Secret Dump via GDB elasticLinux init (PID 1) Secret Dump via GDB	2	3
`process.args`	`eq`	`/dev/mem` elasticManual Memory Password Searching Activity	1
`process_name`	`in`	`cat` elasticManual Memory Dumping via Proc Filesystem elasticSuspicious /proc/maps Discovery	2	28
`process_name`	`in`	`egrep` elasticManual Memory Dumping via Proc Filesystem elasticSuspicious /proc/maps Discovery	2	14
`process_name`	`in`	`fgrep` elasticManual Memory Dumping via Proc Filesystem elasticSuspicious /proc/maps Discovery	2	11
`process_name`	`in`	`grep` elasticManual Memory Dumping via Proc Filesystem elasticSuspicious /proc/maps Discovery	2	18
`process_name`	`in`	`less` elasticManual Memory Dumping via Proc Filesystem elasticSuspicious /proc/maps Discovery	2	15
`process_name`	`in`	`more` elasticManual Memory Dumping via Proc Filesystem elasticSuspicious /proc/maps Discovery	2	14
`process_name`	`in`	`tail` elasticManual Memory Dumping via Proc Filesystem elasticSuspicious /proc/maps Discovery	2	11
`CommandLine`	`wildcard`	`/proc/*/mem` elasticManual Memory Dumping via Proc Filesystem	1
`process.args`	`ne`	`1` elasticLinux Process Hooking via GDB	1
`process.args`	`starts_with`	`/tmp/` elasticPotential Linux Credential Dumping via Proc Filesystem	1	18
`process.args`	`wildcard`	`/proc/*/maps` elasticSuspicious /proc/maps Discovery	1	2
`process.args`	`wildcard`	`if=/proc//mem` elasticPotential Memory Dumping via dd	1

Exclusions (16 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`CurrentDirectory`	`wildcard`	`/opt/Tanium/TaniumClient/*` elasticSuspicious /proc/maps Discovery	1
`CurrentDirectory`	`wildcard`	`/opt/traps/deb-installer` elasticSuspicious /proc/maps Discovery	1
`ParentCommandLine`	`eq`	`/sbin/init` elasticSuspicious /proc/maps Discovery	1
`ParentImage`	`eq`	`/usr/lib/systemd/systemd` elasticSuspicious /proc/maps Discovery	1
`ParentImage`	`in`	`/opt/secl/linux-ir-scripts-v3/thieves.sh` elasticSuspicious /proc/maps Discovery	1
`ParentImage`	`in`	`/opt/traps/rpm-installer/setup.sh` elasticSuspicious /proc/maps Discovery	1
`ParentImage`	`in`	`/sbin/chkrootkit` elasticSuspicious /proc/maps Discovery	1
`ParentImage`	`in`	`/usr/sbin/chkrootkit` elasticSuspicious /proc/maps Discovery	1
`ParentImage`	`wildcard`	`/home/*/sunlight/thieves.sh` elasticSuspicious /proc/maps Discovery	1
`parent_process_name`	`eq`	`uac` elasticSuspicious /proc/maps Discovery	1
`process.group_leader.executable`	`in`	`/opt/traps/bin/cytool` elasticSuspicious /proc/maps Discovery	1
`process.group_leader.executable`	`in`	`/usr/local/qualys/cloud-agent/bin/qualys-cloud-agent` elasticSuspicious /proc/maps Discovery	1
`process.parent.args`	`in`	`./uac` elasticSuspicious /proc/maps Discovery	1
`process.parent.args`	`in`	`/sbin/chkrootkit` elasticSuspicious /proc/maps Discovery	1
`process.parent.args`	`in`	`/usr/bin/finalrd` elasticSuspicious /proc/maps Discovery	1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform: Linux

Domain: Endpoint