Home/ MITRE Matrix/ Credential Access/ T1003.008

T1003.008/etc/passwd and /etc/shadow

T1003.008 — /etc/passwd and /etc/shadow is a MITRE ATT&CK technique in the Credential Access tactic. Clankerusecase tracks 9 detection use cases covering it and 6 threat-intel articles citing it.

Credential Access

View on the matrix → Filter Detection Library MITRE official spec ↗

9Use cases

6Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1003 · OS Credential Dumping

Use cases covering this technique (9)

ESXi Sensitive Files Accessed ESCU actions · alerting P Linux Auditd Possible Access To Credential Files ESCU actions · hunting P Linux Possible Access To Credential Files ESCU actions · hunting P [LLM] Siemens ROX II xz utility misused as cat to read root-owned secrets (CVE-2025-40948) Bespoke actions · hunting DSΣDD [LLM] TeamPCP Linux credential harvest: Python reading /etc/shadow + auth.log + cloud Bespoke actions · hunting DSPDDCS [LLM] Pistache CVE-2022-26068 path traversal reading /etc/passwd via /doc/../ Bespoke exploit · alerting SΣP [LLM] Spring4Shell post-exploitation arbitrary file read (/etc/passwd via relocated docBase) Bespoke actions · alerting SΣPCS [LLM] Dirty Pipe (CVE-2022-0847): /etc/passwd or /etc/shadow modified by unexpected process Bespoke exploit · alerting DSΣPCS [LLM] Node.js process spawning shell/curl to read and exfiltrate /etc/passwd (Dust.js post-exploit) Bespoke actions · alerting DSΣPDDCS

Articles citing this technique (6)

crit Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy art-249

crit How a Poisoned Security Scanner Became the Key to Backdooring LiteLLM art-605

high Fetch the Flag CTF 2022 writeup: Not So Smart Fridge art-1945

crit Spring4Shell extends to Glassfish and Payara: same vulnerability, new exploit art-2351

high "Dirty Pipe" Linux vulnerability and your containerized applications (CVE-2022-0847) art-2501

high Type Manipulation: Escaping Template Sandboxes art-3673