Home/ MITRE Matrix/ Credential Access/ T1003.007

T1003.007Proc Filesystem

T1003.007 — Proc Filesystem is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 8 detection use cases covering it and 8 threat-intel articles citing it.

Credential Access

View on the matrix → Filter Detection Library MITRE official spec ↗

8Use cases

8Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1003 · OS Credential Dumping

Use cases covering this technique (8)

[LLM] Credential harvest via /proc/<pid>/mem read of GitHub Actions Runner.Worker Bespoke actions · hunting DSΣPDDCS [LLM] GitHub Actions Runner.Worker memory read via /proc/<pid>/mem (CI secret unmasking) Bespoke actions · alerting DSΣPDDCS [LLM] Runner.Worker process memory scrape via /proc on self-hosted GitHub Actions runner Bespoke actions · alerting DSΣPDDCS [LLM] CI runner secret theft via /proc/<pid>/mem read of Runner.Worker (Miasma memory scraper) Bespoke actions · hunting SΣPCS [LLM] Process reading /proc/<pid>/mem of GitHub Actions Runner.Worker (in-memory secret extraction) Bespoke actions · alerting DSΣPDDCS [LLM] GitHub Actions Runner.Worker process-memory secret scraping via /proc Bespoke actions · hunting DSΣPDDCS [LLM] python3 reading /proc/<PID>/mem to scrape Runner.Worker secrets Bespoke actions · alerting DSΣPDDCS [LLM] Read of /proc/<pid>/mem targeting GitHub Runner.Worker (TeamPCP credential dump) Bespoke actions · alerting DSΣPDD

Articles citing this technique (8)

crit 10 Layers Deep: How StepSecurity Stops TeamPCP's Trivy Supply Chain Attack on GitHub Actions art-253

high Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised art-274

high simonecorsi/mawesome GitHub Action has been compromised art-275

high Pythagora-io/gpt-pilot Compromised on GitHub - Shai-Hulud Credential Stealer Blocked by Python Linter art-350

high Multiple redhat-cloud-services npm Packages compromised art-370

crit Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages art-425

med actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials art-426

high Behind the Scenes: How StepSecurity Detected and Helped Remediate the Largest npm Supply Chain Attack art-522