Linux: Grep Search for “password” in Executed Commands

Flags Linux process executions running grep with “password” in the command line.

FreeUnreviewedSigmahighv1

linux-grep-search-for-password-in-executed-commands-df3fcaea

title: "Linux: Grep Search for “password” in Executed Commands"
id: b8095884-723f-49c5-b308-2b0a2ec2c96b
status: test
description: This rule matches Linux auditd EXECVE events where the executed command line includes both “grep” and “password”. Searching for password strings in files is commonly used to locate credential material or related data before further access attempts. The detection relies on process execution telemetry capturing the command line arguments via auditd.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_find_cred_in_files.yml
author: Igor Fits, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2023-04-30
tags:
  - attack.credential-access
  - attack.t1552.001
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
  keywords:
    "|all":
      - grep
      - password
  condition: selection and keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: df3fcaea-2715-4214-99c5-0056ea59eb35
    type: derived

What it detects

This rule matches Linux auditd EXECVE events where the executed command line includes both “grep” and “password”. Searching for password strings in files is commonly used to locate credential material or related data before further access attempts. The detection relies on process execution telemetry capturing the command line arguments via auditd.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.