T1003.007 Proc Filesystem
Adversaries may gather credentials from information stored in the Proc filesystem or /proc. The Proc filesystem on Linux contains a great deal of information regarding the state of the running operating system. Processes running with root privileges can use this facility to scrape live memory of other running programs. If any of these programs store passwords in clear text or password hashes in memory, these values can then be harvested for either usage or brute force attacks, respectively.
This functionality has been implemented in the MimiPenguin, an open source tool inspired by Mimikatz. The tool dumps process memory, then harvests passwords and hashes by looking for text strings and regex patterns for how given applications such as Gnome Keyring, sshd, and Apache use memory to store such authentication artifacts.
Procedure Examples
Mitigations
| ID |
Mitigation |
Description |
| M1027 |
Password Policies |
Ensure that root accounts have complex, unique passwords across all systems on the network. |
| M1026 |
Privileged Account Management |
Follow best practices in restricting access to privileged accounts to avoid hostile programs from accessing sensitive information. |
Detection
References