T1003.008 · threatengine.sh

Home/ATT&CK Technique//etc/passwd and /etc/shadow

ATT&CK Technique

/etc/passwd and /etc/shadow

T1003.008 · credential-access

Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information, including password hashes in /etc/shadow. By default, /etc/shadow is only readable by the root user.

Linux stores user information such as user ID, group ID, home directory path, and login shell in /etc/passwd. A "user" on the system may belong to a person or a service. All password hashes are stored in /etc/shadow - including entries for users with no passwords and users with locked or disabled accounts.

Adversaries may attempt to read or dump the /etc/passwd and /etc/shadow files on Linux systems via command line utilities such as the cat command. Additionally, the Linux utility unshadow can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper - for example, via the command /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db. Since the user information stored in /etc/passwd are linked to the password hashes in /etc/shadow, an adversary would need to have access to both.

Linux

◆

Actors Using This

13

chinaAPT17
chinaAPT3
chinaBlackTech
russiaCadet Blizzard
israel_private_sector_mobile_forensics_cyber_mercenaryCellebrite
chinaDaggerfly
russiaDragonfly
chinaEarth Lusca
chinaAPT27
iranPioneer Kitten
chinaSalt Typhoon
financially_motivated_cybercrime_cloud_native_cryptojacking_specialist_german_speaking_indicatorsTeamTNT (Cloud Cryptojacking Operator)
china_nexus_suspected_mandiant_unc5325_ivanti_2024_zero_day_specialistUNC5325 (Ivanti Connect Secure 2024 Operator)

◈

Likely Attack Path

Techniques the same actors pair with this one distinctively - those showing up among actors who use this technique noticeably more than across all actors (lift > 1.15), grouped by kill-chain phase. The × is that lift multiplier; the shared-actor count is in the tooltip. A near-universal technique pairs with everything at baseline, so its list is short by design.

resource-development earlier

T1584.004 · Server ×4.95

initial-access earlier

T1195.002 · Compromise Software Supply Chain ×3.92

execution earlier

T1574.006 · Dynamic Linker Hijacking ×8.14

persistence earlier

T1136.001 · Local Account ×6.10 T1556 · Modify Authentication Process ×4.88

credential-access same

T1110.001 · Password Guessing ×5.91 T1212 · Exploitation for Credential Access ×5.38 T1110.003 · Password Spraying ×5.05 T1110.004 · Credential Stuffing ×4.58 T1003.002 · Security Account Manager ×4.02

discovery later

T1482 · Domain Trust Discovery ×4.88

lateral-movement later

T1021.004 · SSH ×4.11

other same

T1601.001 · Patch System Image ×9.15 T1070.002 · Clear Linux or Mac System Logs ×6.10 T1601 · Modify System Image ×6.10

▸

Atomic Tests

5

Executable Atomic Red Team test cases for exercising this technique in a lab. Copy a command, run it on the listed platform, confirm your detections fire.

bashelevatedlinuxAccess /etc/shadow (Local)

/etc/shadow file is accessed in Linux environments

sudo cat /etc/shadow > #{output_file}
cat #{output_file}

shelevatedlinuxAccess /etc/master.passwd (Local)

/etc/master.passwd file is accessed in FreeBSD environments

sudo cat /etc/master.passwd > #{output_file}
cat #{output_file}

shlinuxAccess /etc/passwd (Local)

/etc/passwd file is accessed in FreeBSD and Linux environments

cat /etc/passwd > #{output_file}
cat #{output_file}

shelevatedlinuxAccess /etc/{shadow,passwd,master.passwd} with a standard bin that's not cat

Dump /etc/passwd, /etc/master.passwd and /etc/shadow using ed

unamestr=$(uname)
if [ "$unamestr" = 'Linux' ]; then echo -e "e /etc/passwd\n,p\ne /etc/shadow\n,p\n" | ed > #{output_file}; elif [ "$unamestr" = 'FreeBSD' ]; then echo -e "e /etc/passwd\n,p\ne /etc/master.passwd\n,p\ne /etc/shadow\n,p\n" | ed > #{output_file}; fi

shelevatedlinuxAccess /etc/{shadow,passwd,master.passwd} with shell builtins

Dump /etc/passwd, /etc/master.passwd and /etc/shadow using sh builtins

testcat(){ (while read line; do echo $line >> #{output_file}; done < $1) }
[ "$(uname)" = 'FreeBSD' ] && testcat /etc/master.passwd
testcat /etc/passwd
testcat /etc/shadow

▣

Mitigations

2

MITRE ATT&CK mitigations - vendor-agnostic guidance for reducing exposure to this technique.

M1026Privileged Account Management

Privileged Account Management focuses on implementing policies, controls, and tools to securely manage privileged accounts (e.g., SYSTEM, root, or administrative accounts). This includes restricting access, limiting the scope of permissions, monitoring privileged account usage, and ensuring accountability through logging and auditing.

Account Permissions and Roles

Implement RBAC and least privilege principles to allocate permissions securely.
Use tools like Active Directory Group Policies to enforce access restrictions.

Credential Security

Deploy password vaulting tools like CyberArk, HashiCorp Vault, or KeePass for secure storage and rotation of credentials.
Enforce password policies for complexity, uniqueness, and expiration using tools like Microsoft Group Policy Objects (GPO).

Multi-Factor Authentication (MFA)

Enforce MFA for all privileged accounts using Duo Security, Okta, or Microsoft Azure AD MFA.

Privileged Access Management (PAM)

Use PAM solutions like CyberArk, BeyondTrust, or Thycotic to manage, monitor, and audit privileged access.

Auditing and Monitoring

Integrate activity monitoring into your SIEM (e.g., Splunk or QRadar) to detect and alert on anomalous privileged account usage.

Just-In-Time Access

Deploy JIT solutions like Azure Privileged Identity Management (PIM) or configure ephemeral roles in AWS and GCP to grant time-limited elevated permissions.

Tools for Implementation Privileged Access Management (PAM)

CyberArk, BeyondTrust, Thycotic, HashiCorp Vault.

Credential Management

Microsoft LAPS (Local Admin Password Solution), Password Safe, HashiCorp Vault, KeePass.

Multi-Factor Authentication

Duo Security, Okta, Microsoft Azure MFA, Google Authenticator.

Linux Privilege Management

sudo configuration, SELinux, AppArmor.

Just-In-Time Access

Azure Privileged Identity Management (PIM), AWS IAM Roles with session constraints, GCP Identity-Aware Proxy.

M1027Password Policies

Set and enforce secure password policies for accounts to reduce the likelihood of unauthorized access. Strong password policies include enforcing password complexity, requiring regular password changes, and preventing password reuse.

Windows Systems

Use Group Policy Management Console (GPMC) to configure

Minimum password length (e.g., 12+ characters).
Password complexity requirements.
Password history (e.g., disallow last 24 passwords).
Account lockout duration and thresholds.

Linux Systems

Configure Pluggable Authentication Modules (PAM)

Use pam_pwquality to enforce complexity and length requirements.
Implement pam_tally2 or pam_faillock for account lockouts.
Use pwunconv to disable password reuse.

Password Managers

Enforce usage of enterprise password managers (e.g., Bitwarden, 1Password, LastPass) to generate and store strong passwords.

Password Blacklisting

Use tools like Have I Been Pwned password checks or NIST-based blacklist solutions to prevent users from setting compromised passwords.

Regular Auditing

Periodically audit password policies and account configurations to ensure compliance using tools like LAPS (Local Admin Password Solution) and vulnerability scanners.

Tools for Implementation Windows

Group Policy Management Console (GPMC): Enforce password policies.
Microsoft Local Administrator Password Solution (LAPS): Enforce random, unique admin passwords.

Linux/macOS

PAM Modules (pam_pwquality, pam_tally2, pam_faillock): Enforce password rules.
Lynis: Audit password policies and system configurations.

Cross-Platform

Password Managers (Bitwarden, 1Password, KeePass): Manage and enforce strong passwords.
Have I Been Pwned API: Prevent the use of breached passwords.
NIST SP 800-63B compliant tools: Enforce password guidelines and blacklisting.

◈

Detection Coverage

0/6 layers

Coverage across standard detection surfaces. Rows marked none have no rule of that type mapped. Some are real blind spots worth closing; others are simply not applicable to this technique (e.g. YARA matches malware files, not network behaviour).

Behavioral / log (Sigma) none

Analytics (MITRE CAR) none

Runtime / container (Falco) none

File / malware (YARA) none

Network (Suricata/Snort) none

Vuln scan (Nuclei) none

▣

Comply & Defend

NIST 800-53AC-02, AC-03, AC-05, AC-06, CA-07, CM-02, CM-05, CM-06, IA-02, IA-05, SC-28, SC-39, SI-03, SI-04

D3FEND12 defensive techniques

Intelligence Graph · click any node to traverse

CVETechnique ActorTool Family

drag to reposition · click any node to traverse · button top-right enlarges

External lookups - second-class, for what we don’t hold ourselves

MITRE ATT&CK Atomic Red Team car (MITRE)

Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities

Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs

Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures

Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1

About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service

threatengine.sh · Open-source threat intelligence platform · 100+ authoritative sources · Every fact traces to its origin