Copy Passwd Or Shadow From TMP Path

Title: Copy Passwd Or Shadow From TMP Path
Status: test
Description:Detects when the file "passwd" or "shadow" is copied from tmp path
References:
  -https://blogs.blackberry.com/
  -https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-01-31
modified:None
Tags:

• -'attack.credential-access'
• -'attack.t1552.001'

Logsource:

• product: linux
• category: process_creation

Detection:
  selection_img:
    Image|endswith: '/cp'
  selection_path:
    CommandLine|contains: '/tmp/'
  selection_file:
    CommandLine|contains:
      -'passwd'
      -'shadow'

  condition:all of selection_*
Falsepositives:
  -Unknown
Level: high