Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1003.007sub-technique of T1003 OS Credential Dumping

Proc Filesystem

Linuxnothing on this site yetT1003.007 on attack.mitre.org

Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. For each process, the `/proc/<PID>/maps` file shows how memory is mapped within the process’s virtual address space. And `/proc/<PID>/mem`, exposed for debugging purposes, provides access to the process’s virtual address space.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

how MITRE says to see it

Detecting OS Credential Dumping via /proc Filesystem Access on Linux

  • Monitoring adversary access to sensitive process memory via the /proc filesystem to extract credential material, often involving multi-step access to /proc/[pid]/mem or /proc/[pid]/maps combined with privilege escalation or credential scraping binaries.

what reduces it

  • M1027 Password Policies. Ensure that root accounts have complex, unique passwords across all systems on the network.
  • M1026 Privileged Account Management. Follow best practices in restricting access to privileged accounts to avoid hostile programs from accessing sensitive information.

the rest of T1003

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.