Linux: Copy passwd or shadow from /tmp using cp

title: "Linux: Copy passwd or shadow from /tmp using cp"
id: 6e90e297-3dd0-4ec0-9bfc-42ae9bf0796c
status: test
description: This rule flags Linux process executions where the command line contains a /tmp/ path and the file name 'passwd' or 'shadow', and the invoked image ends with '/cp'. Copying these files from temporary locations is a common step toward credential theft or offline password processing. It relies on process creation telemetry including the command line and executable image path.
references:
  - https://blogs.blackberry.com/
  - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_cp_passwd_or_shadow_tmp.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-01-31
tags:
  - attack.credential-access
  - attack.t1552.001
logsource:
  product: linux
  category: process_creation
detection:
  selection_img:
    Image|endswith: /cp
  selection_path:
    CommandLine|contains: /tmp/
  selection_file:
    CommandLine|contains:
      - passwd
      - shadow
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: fa4aaed5-4fe0-498d-bbc0-08e3346387ba
    type: derived