Credentials In Files - Linux

Title: Credentials In Files - Linux
Status: test
Description:Detecting attempts to extract passwords with grep
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
Author: Igor Fits, oscd.community
Date: 2020-10-15
modified:2023-04-30
Tags:

• -'attack.credential-access'
• -'attack.t1552.001'

Logsource:

• product: linux
• service: auditd

Detection:
  selection:
    type: 'EXECVE'
  keywords:
    |all:
      -'grep'
      -'password'

  condition:selection and keywords
Falsepositives:
  -Unknown
Level: high