T1003.008 — /etc/passwd and /etc/shadow

Tactic: Credential Access · Platforms: Linux

Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking. Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information, including password hashes in /etc/shadow. By default, /etc/shadow…

Sub-technique of OS Credential Dumping (T1003).

Sigma detection rules (1)

T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow

title: "T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow"
id: 83bd38fe-a02f-4553-aa66-760c5fb5a9e1
description: 'Credential Access via /etc/passwd and /etc/shadow Parsing. (Retargeted to the file_event auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: exe, user, PATH, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1003/008
author: Shahrukh Khan
date: 2026-01-24
license: MIT
tags:
  - attack.credential-access
  - attack.t1003.008

logsource:
  category: file_event
  product: linux

detection:
  selection_unshadow:
    type: EXECVE
    a0|endswith: '/unshadow'
  selection_cat:
    type: EXECVE
    a0|endswith:
      - '/cat'
      - '/cp'
    a1: '/etc/shadow'
  condition: 1 of selection_*

falsepositives:
  - System administrators legitimately using cat/cp on /etc/shadow for backups or migration, or unshadow as part of authorized password-audit workflows.

level: high

Related sub-techniques

Explore