Linux: Grep used to search for passwords in files (auditd EXECVE)

Flags Linux process executions running grep with “password” in the command line.

FreeReviewedSigma · High · v3

Product: linux
Service: auditd
Author: Igor Fits, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-15
Updated: 2026-07-31

ATT&CK techniques

Cred Access

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
- T1552.001Credentials In Files
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Linux process executions where the executed command line includes both 'grep' and 'password', indicating an attempt to locate password material within files. Such searching behavior is commonly used during credential discovery and can precede additional credential access steps. It relies on auditd EXECVE telemetry capturing the command execution context and keyword presence in the invocation.

Reporting behind it

Related detections9 linkedT1552.001 — drag to rearrange

Malicious Veeam Backup Credential Theft via psql Query of Credentials Table (via process_creation)

Malicious Marimo Notebook Credential File Access via Shell (via process_creation)

Malicious Keyhunter Worker Persistence via Systemd Service

Suspicious TruffleHog Execution Spawned by Bun Runtime via Process Creation

Malicious AWS Credential Exfiltration via Curl or Wget in Process Creation

Suspicious sqlite3 Access to gcloud Cached Access Token Database (via process_creation)

Suspicious AWS GetCallerIdentity From TruffleHog User Agent via Cloudtrail

Suspicious GitHub CLI Auth Token Extraction via Command Line

Suspicious Access to macOS Login Keychain by Slow Pisces (via process_creation)

Linux: Grep used to search for passwords in files (auditd EXECVE)

Pivot detection · T1552.001 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-grep-search-for-password-in-executed-commands-df3fcaea

title: "Linux: Grep used to search for passwords in files (auditd EXECVE)"
id: b8095884-723f-49c5-b308-2b0a2ec2c96b
status: test
description: This rule flags Linux process executions where the executed command line includes both 'grep' and 'password', indicating an attempt to locate password material within files. Such searching behavior is commonly used during credential discovery and can precede additional credential access steps. It relies on auditd EXECVE telemetry capturing the command execution context and keyword presence in the invocation.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1552.001/T1552.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_find_cred_in_files.yml
author: Igor Fits, oscd.community, Huntrule Team
date: 2020-10-15
modified: 2023-04-30
tags:
  - attack.credential-access
  - attack.t1552.001
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
  keywords:
    "|all":
      - grep
      - password
  condition: selection and keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: df3fcaea-2715-4214-99c5-0056ea59eb35
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL