Suspicious access to shadow file

Synopsis

Field	Value
Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	7 Days
Required Data	XDR Agent with eXtended Threat Hunting (XTH)
Detector Tags	Kubernetes - AGENT, Containers
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	OS Credential Dumping (T1003)
Severity	Informational

Description

An unpopular process accessed the shadow file.

Attacker's Goals

Attackers may attempt to dump the contents of these sensitive files to perform offline password cracking.

Investigative actions

• Check the process for more suspicious activity.
• Check whether this was a legitimate action.

Variations

Suspicious access to shadow file in a Kubernetes Pod using a known text editor

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	OS Credential Dumping (T1003)
Severity	Medium

Description

An unpopular process accessed the shadow file in a Kubernetes Pod.

Attacker's Goals

Attackers may attempt to dump the contents of these sensitive files to perform offline password cracking.

Investigative actions

• Check the process for more suspicious activity.
• Check whether this was a legitimate action.

Suspicious access to shadow file using a known text editor

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	OS Credential Dumping (T1003)
Severity	Medium

Description

An unpopular process accessed the shadow file.

Attacker's Goals

Attackers may attempt to dump the contents of these sensitive files to perform offline password cracking.

Investigative actions

• Check the process for more suspicious activity.
• Check whether this was a legitimate action.

Suspicious access to shadow file in a Kubernetes Pod

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	OS Credential Dumping (T1003)
Severity	Low

Description

An unpopular process accessed the shadow file.

Attacker's Goals

Attackers may attempt to dump the contents of these sensitive files to perform offline password cracking.

Investigative actions

• Check the process for more suspicious activity.
• Check whether this was a legitimate action.

Suspicious access to shadow file

Synopsis

Field	Value
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	OS Credential Dumping (T1003)
Severity	Low

Description

An unpopular process accessed the shadow file.

Attacker's Goals

Attackers may attempt to dump the contents of these sensitive files to perform offline password cracking.

Investigative actions

• Check the process for more suspicious activity.
• Check whether this was a legitimate action.