Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1003.008sub-technique of T1003 OS Credential Dumping

/etc/passwd and /etc/shadow

Linuxnothing on this site yetT1003.008 on attack.mitre.org

Adversaries may attempt to dump the contents of `/etc/passwd` and `/etc/shadow` to enable offline password cracking. Most modern Linux operating systems use a combination of `/etc/passwd` and `/etc/shadow` to store user account information, including password hashes in `/etc/shadow`. By default, `/etc/shadow` is only readable by the root user. Linux stores user information such as user ID, group ID, home directory path, and login shell in `/etc/passwd`.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

Playbook for this stage

Cloud account compromise

Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.

how MITRE says to see it

Credential Access via /etc/passwd and /etc/shadow Parsing

  • Adversaries attempt to read sensitive files such as /etc/passwd and /etc/shadow for credential dumping. This may involve access to the files directly via command-line utilities (e.g., cat, less), creation of backup copies, or parsing through post-exploitation frameworks.

what reduces it

  • M1027 Password Policies. Ensure that root accounts have complex, unique passwords across all systems on the network.
  • M1026 Privileged Account Management. Follow best practices in restricting access to privileged accounts to avoid hostile programs from accessing such sensitive information.

the rest of T1003

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.