Linux process copying passwd or shadow from /tmp

Alerts on Linux cp commands that copy /tmp-based passwd or shadow files.

FreeReviewedSigma · High · v3

Product: linux
Category: process_creation
Author: Joseliyo Sanchez, @Joseliyo_Jstnk (SigmaHQ), DRL 1.1
Published: 2023-01-31
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552.001Credentials In Files
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

Identifies Linux process activity where the command line indicates copying sensitive credential files named "passwd" or "shadow" while the command line includes a /tmp path. Attackers may stage or manipulate these files to access or prepare credential data outside normal locations. The rule relies on process creation telemetry, matching command-line content patterns that include /tmp and the target filenames.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange

Malicious Marimo Notebook Credential File Access via Shell (via process_creation)

Malicious Keyhunter Worker Persistence via Systemd Service

Suspicious TruffleHog Execution Spawned by Bun Runtime via Process Creation

Malicious AWS Credential Exfiltration via Curl or Wget in Process Creation

Suspicious sqlite3 Access to gcloud Cached Access Token Database (via process_creation)

Suspicious AWS GetCallerIdentity From TruffleHog User Agent via Cloudtrail

Suspicious GitHub CLI Auth Token Extraction via Command Line

Suspicious Access to macOS Login Keychain by Slow Pisces (via process_creation)

Suspicious mdfind Search for Private Key Files on macOS (via process_creation)

Linux process copying passwd or shadow from /tmp

Pivot detection · T1552.001 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-copy-passwd-or-shadow-from-tmp-using-cp-fa4aaed5

title: Linux process copying passwd or shadow from /tmp
id: 6e90e297-3dd0-4ec0-9bfc-42ae9bf0796c
status: test
description: Identifies Linux process activity where the command line indicates copying sensitive credential files named "passwd" or "shadow" while the command line includes a /tmp path. Attackers may stage or manipulate these files to access or prepare credential data outside normal locations. The rule relies on process creation telemetry, matching command-line content patterns that include /tmp and the target filenames.
references:
  - https://blogs.blackberry.com/
  - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_cp_passwd_or_shadow_tmp.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-01-31
tags:
  - attack.credential-access
  - attack.t1552.001
logsource:
  product: linux
  category: process_creation
detection:
  selection_img:
    Image|endswith: /cp
  selection_path:
    CommandLine|contains: /tmp/
  selection_file:
    CommandLine|contains:
      - passwd
      - shadow
  condition: all of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: fa4aaed5-4fe0-498d-bbc0-08e3346387ba
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL