T1003.007 — Proc Filesystem

Tactic: Credential Access · Platforms: Linux

Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. For each process, the `/proc/<PID>/maps` file shows how memory is mapped within the…

Sub-technique of OS Credential Dumping (T1003).

Sigma detection rules (1)

T1003.007 OS Credential Dumping: Proc Filesystem

title: "T1003.007 OS Credential Dumping: Proc Filesystem"
id: fea46e05-c8e2-492a-aaf3-898d11a28ca7
description: 'Detecting OS Credential Dumping via /proc Filesystem Access on Linux. (Retargeted to the process_access auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AccessedFilePath, ProcessName, UserContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1003/007
author: Shahrukh Khan
date: 2026-01-18
license: MIT
tags:
  - attack.credential-access
  - attack.t1003.007

logsource:
  category: process_access
  product: linux

detection:
  selection_tool:
    type: EXECVE
    a0|endswith:
      - '/gcore'
      - '/gdb'
  selection_procmem:
    type: PATH
    name|contains: '/proc/'
    name|endswith: '/mem'
  condition: 1 of selection_*

falsepositives:
  - Legitimate debugging or crash-dump collection by developers/support engineers using gdb/gcore against non-credential processes.

level: high

Related sub-techniques

Explore