T1003.007Proc Filesystem
T1003.007 — Proc Filesystem is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 9 detection use cases covering it and 9 threat-intel articles citing it.
Credential Access
9Use cases
9Articles
0Sub-techniques
1Tactic
↑ Parent technique: T1003 · OS Credential Dumping
Use cases covering this technique (9)
[LLM] TeamPCP Cloud Stealer reading CI runner process memory via /proc/<pid>/mem [LLM] Credential harvest via /proc/<pid>/mem read of GitHub Actions Runner.Worker [LLM] GitHub Actions Runner.Worker memory read via /proc/<pid>/mem (CI secret unmasking) [LLM] Runner.Worker process memory scrape via /proc on self-hosted GitHub Actions runner [LLM] CI runner secret theft via /proc/<pid>/mem read of Runner.Worker (Miasma memory scraper) [LLM] Process reading /proc/<pid>/mem of GitHub Actions Runner.Worker (in-memory secret extraction) [LLM] GitHub Actions Runner.Worker process-memory secret scraping via /proc [LLM] python3 reading /proc/<PID>/mem to scrape Runner.Worker secrets [LLM] Read of /proc/<pid>/mem targeting GitHub Runner.Worker (TeamPCP credential dump)Articles citing this technique (9)
crit Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List. art-35