Shadow or passwd file named on a Linux command line

1title: Shadow or passwd file named on a Linux command line2id: c6c302c2-3197-4bde-87f3-dfbc8a1748fd3status: experimental4description: |5  Matches the execve leg of AN1234: a process launched with /etc/shadow on its6  command line, the unshadow utility that joins the two files into a cracking7  input, or /etc/passwd handed to a binary whose job is to copy, archive, encode8  or ship a file elsewhere. The match sits on CommandLine rather than on Image9  because MITRE's `exe` knob names cat, cp and awk while the same read is10  equally served by less, strings, tar, base64, head or a python one-liner, so11  keying on the reader would miss most of the ways this actually happens;12  unshadow is matched on Image as well, since an adversary who copied the pair13  out first invokes it against the copies and puts neither /etc path in argv.14  /etc/passwd on its own is deliberately not enough: it is world-readable and15  named on command lines constantly by ordinary administration, so it is gated16  on a transfer or archiving binary — that gate is authored here, not taken from17  MITRE, which names only the `exe` knob. Two limits follow from using execve. A18  shell builtin read (`while read line < /etc/shadow`) forks no process, and a19  program that opens the file through a path it builds at runtime never puts it20  in argv; the analytic's other log source, an auditd file-access watch such as21  `-w /etc/shadow -p r`, is the complement that catches both. Prerequisite: a22  stock auditd install ships no execve rule, so without an explicit23  `-a always,exit -F arch=b64 -S execve` there is no process_creation telemetry24  on the host at all and this returns zero rows regardless of what ran — zero25  rows reads as quiet when it means blind.26  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0446, not hand-written and not tested by its author. Any lab result is on this rule's own page.27references:28  - https://attack.mitre.org/techniques/T1003/00829  - https://attack.mitre.org/detectionstrategies/DET044630author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)31date: 2026-08-1632tags:33  - attack.credential-access34  - attack.t1003.00835logsource:36  category: process_creation37  product: linux38detection:39  selection_shadow:40    CommandLine|contains: '/etc/shadow'41  selection_unshadow:42    Image|endswith: '/unshadow'43  selection_passwd_moved:44    CommandLine|contains: '/etc/passwd'45    Image|endswith:46      - '/cp'47      - '/tar'48      - '/base64'49      - '/xxd'50      - '/curl'51      - '/scp'52      - '/nc'53      - '/nc.openbsd'54      - '/nc.traditional'55      - '/netcat'56      - '/ncat'57  condition: 1 of selection*58falsepositives:59  - "Compliance and hardening scanners that read /etc/shadow by absolute path on every host on a schedule — Lynis, oscap remediation scripts, CIS-benchmark shell scripts and AIDE or Tripwire wrappers all grep, awk or checksum it as a standard check. This is a predictable, recurring, estate-wide match and the highest-volume one this rule has, which is why it is scored medium rather than high."60  - "Administrators troubleshooting a locked, expired or non-hashing account with sudo cat /etc/shadow or grep <user> /etc/shadow, and password-age audits run by hand from a runbook. The command is identical to the one this rule is written for and only the operator account separates them."61  - "Account-management procedures that take a backup before a bulk change, such as cp /etc/passwd /etc/passwd.bak or cp /etc/shadow /root/shadow.$(date +%F) ahead of a mass useradd, a UID renumbering or a directory migration."62  - "Container image builds and chroot or distroless staging that copy /etc/passwd into the output tree so the runtime user resolves, which is routine in CI and matches selection_passwd_moved through /cp and /tar."63  - "Backup jobs invoking tar with an explicit include list that names /etc/passwd and /etc/shadow, producing one match per host per backup window under a service account."64level: medium