Live Active security incident? Get immediate response
MITRE ATT&CK® Technique

T1003.007: Proc Filesystem

Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. For each process, the `/proc//maps` file shows how memory is mapped within the process’s virtual address space. And `/proc//mem`, exposed for debugging purposes, provides access to the process’s virtual address space.[1][2]

When executing with root privileges, adversaries can search these memory locations for all processes on a system that contain patterns indicative of credentials. Adversaries may use regex patterns, such as grep -E "^[0-9a-f-]* r" /proc/"$pid"/maps | cut -d' ' -f 1, to look for fixed strings in memory structures or cached hashes.[3] When running without privileged access, processes can still view their own virtual memory locations. Some services or programs may save credentials in clear text inside the process’s memory.[4][5]

If running as or with the permissions of a web browser, a process can search the `/maps` & `/mem` locations for common website credential patterns (that can also be used to find adjacent memory within the same structure) in which hashes or cleartext credentials may be located.

EnterpriseT1003.007Sub-techniqueObject v1.2 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence High

This Linux credential-access behavior matters because it targets secrets that may be sitting in process memory and exposed through the /proc pseudo-filesystem. If an attacker gains root privileges, or runs with the permissions of a process that can read its own memory, they may be able to recover cleartext credentials, hashes, or browser-related credential material. For leaders, the practical risk is credential reuse after an initial compromise: one affected Linux host can become a source of accounts that enable broader access.

Executive priority

Prioritize this as a Linux identity and incident-response readiness issue, not just a malware signature problem. Executives should ask whether privileged access to Linux systems is tightly controlled, whether SOC teams can see suspicious access to /proc/<PID>/maps and /proc/<PID>/mem, and whether incident responders have a playbook for credential exposure after Linux host compromise. This technique also supports audit and compliance conversations around privileged account management, password policy, logging, and evidence that sensitive credentials are not unnecessarily exposed in application memory.

Technical view

T1003.007 is a Linux sub-technique of OS Credential Dumping under Credential Access. The supplied ATT&CK description centers on adversaries inspecting process memory mappings and memory contents through /proc, especially when running as root or within the permissions of a process such as a browser. SOC and detection engineering teams should validate DET0593-style coverage for abnormal process access to /proc memory interfaces, especially access patterns involving /proc/<PID>/maps and /proc/<PID>/mem by unexpected processes, scripts, or credential-dumping tools. Relationship context identifies MimiPenguin, LaZagne, and PACEMAKER as software that uses this behavior, so detections should not rely only on tool names; they should also look for the underlying filesystem and process-memory access behavior.

Likely telemetry

  • Linux process execution telemetry, including command line, parent process, user, and privilege context
  • File access telemetry for /proc/<PID>/maps and /proc/<PID>/mem where available
  • Audit logs showing privileged account use, sudo/root activity, and access to sensitive process memory interfaces
  • Endpoint detection telemetry from Linux hosts capable of recording process-to-file interactions
  • Shell/script execution evidence on Linux systems

Detection direction

  • Validate whether Linux telemetry records reads or attempted reads of /proc/<PID>/maps and /proc/<PID>/mem; many environments collect process starts but not detailed /proc file access.
  • Tune for suspicious combinations: unexpected process memory inspection, root-context access across multiple processes, scripting utilities reading /proc memory-related paths, or browser-context processes searching their own memory.
  • Use DET0593 as the relationship-driven detection strategy reference, but confirm locally what data sources are actually available and retained.
  • Account for legitimate debugging, troubleshooting, profiling, and administrative activity that may access /proc; detections should include user role, host role, process lineage, and change-window context.
  • Do not depend solely on known software names such as MimiPenguin, LaZagne, or PACEMAKER because the ATT&CK behavior can be implemented with other tooling or scripts.

Mitigation priorities

  • Start with M1026 Privileged Account Management: restrict root and administrative access, enforce least privilege, monitor privileged sessions, and maintain accountability through logging and auditing.
  • Apply M1027 Password Policies to reduce downstream risk if credentials or hashes are exposed, including strong password practices and controls against reuse where applicable.
  • Review Linux services and applications for cases where credentials may remain in cleartext process memory; prioritize high-value systems and internet-facing workloads.
  • Harden operational practices around debugging and memory inspection so legitimate access to /proc memory interfaces is limited, logged, and explainable.
  • Ensure incident response procedures include credential rotation and account review when Linux process-memory credential dumping is suspected.
Analyst notes and limits

The ATT&CK object has no official detection text, so this take relies on the technique description and supplied relationships. The strongest defensive decision point is whether the organization can observe and investigate suspicious /proc memory access on Linux, especially under privileged accounts. The software relationships show this behavior is used by multiple tools, including Linux-focused and cross-platform credential recovery tools, but those relationships should be treated as context rather than a complete detection list.

The supplied fields do not prove current exploitation, specific victim exposure, or guaranteed detectability. Detection feasibility depends on local Linux audit, EDR, and logging configuration. The mitigation relationship descriptions are broad, and environment-specific hardening details require local system, application, and identity architecture review.

Official MITRE ATT&CK definition

Proc Filesystem

Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. For each process, the `/proc//maps` file shows how memory is mapped within the process’s virtual address space. And `/proc//mem`, exposed for debugging purposes, provides access to the process’s virtual address space.[1][2]

When executing with root privileges, adversaries can search these memory locations for all processes on a system that contain patterns indicative of credentials. Adversaries may use regex patterns, such as grep -E "^[0-9a-f-]* r" /proc/"$pid"/maps | cut -d' ' -f 1, to look for fixed strings in memory structures or cached hashes.[3] When running without privileged access, processes can still view their own virtual memory locations. Some services or programs may save credentials in clear text inside the process’s memory.[4][5]

If running as or with the permissions of a web browser, a process can search the `/maps` & `/mem` locations for common website credential patterns (that can also be used to find adjacent memory within the same structure) in which hashes or cleartext credentials may be located.

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

1 rows
Domain ID Name Relationship / procedure
Enterprise T1003 OS Credential Dumping This object subtechnique of OS Credential Dumping.
Associated objects

Groups, software, and campaigns

Malware Enterprise

S1109: PACEMAKER

PACEMAKER is a credential stealer that was used by APT5 as early as 2020 including activity against US Defense Industrial Base (DIB) companies.[1]

Network DevicesLinux
Tool Enterprise

S0349: LaZagne

LaZagne is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. LaZagne is publicly available on GitHub.[1]

LinuxmacOSWindows
Relationship explorer

All related ATT&CK context

uses · Malware S1109: PACEMAKER Enterprise detects · Detection Strategy DET0593: Detecting OS Credential Dumping via /proc Filesystem Access on Linux Enterprise mitigates · Mitigation M1027: Password Policies Enterprise subtechnique of · Technique T1003: OS Credential Dumping Enterprise uses · Tool S0349: LaZagne Enterprise mitigates · Mitigation M1026: Privileged Account Management Enterprise uses · Tool S0179: MimiPenguin Enterprise
Mitigations

Mitigation direction

Mitigation Enterprise

M1027: Password Policies

Set and enforce secure password policies for accounts to reduce the likelihood of unauthorized access. Strong password policies include enforcing password complexity, requiring regular password changes, and preventing password reuse. This mitigation can be implemented through the following measures:

Windows Systems:

- Use Group Policy Management Console (GPMC) to configure: - Minimum password length (e.g., 12+ characters). - Password complexity requirements. - Password history (e.g., disallow last 24 passwords). - Account lockout duration and thresholds.

Linux Systems:

- Configure Pluggable Authentication Modules (PAM): - Use `pam_pwquality` to enforce complexity and length requirements. - Implement `pam_tally2` or `pam_faillock` for account lockouts. - Use `pwunconv` to disable password reuse.

Password Managers:

- Enforce usage of enterprise password managers (e.g., Bitwarden, 1Password, LastPass) to generate and store strong passwords.

Password Blacklisting:

- Use tools like Have I Been Pwned password checks or NIST-based blacklist solutions to prevent users from setting compromised passwords.

Regular Auditing:

- Periodically audit password policies and account configurations to ensure compliance using tools like LAPS (Local Admin Password Solution) and vulnerability scanners.

*Tools for Implementation*

Windows:

- Group Policy Management Console (GPMC): Enforce password policies. - Microsoft Local Administrator Password Solution (LAPS): Enforce random, unique admin passwords.

Linux/macOS:

- PAM Modules (pam_pwquality, pam_tally2, pam_faillock): Enforce password rules. - Lynis: Audit password policies and system configurations.

Cross-Platform:

- Password Managers (Bitwarden, 1Password, KeePass): Manage and enforce strong passwords. - Have I Been Pwned API: Prevent the use of breached passwords. - NIST SP 800-63B compliant tools: Enforce password guidelines and blacklisting.

Mitigation Enterprise

M1026: Privileged Account Management

Privileged Account Management focuses on implementing policies, controls, and tools to securely manage privileged accounts (e.g., SYSTEM, root, or administrative accounts). This includes restricting access, limiting the scope of permissions, monitoring privileged account usage, and ensuring accountability through logging and auditing.This mitigation can be implemented through the following measures:

Account Permissions and Roles:

- Implement RBAC and least privilege principles to allocate permissions securely. - Use tools like Active Directory Group Policies to enforce access restrictions.

Credential Security:

- Deploy password vaulting tools like CyberArk, HashiCorp Vault, or KeePass for secure storage and rotation of credentials. - Enforce password policies for complexity, uniqueness, and expiration using tools like Microsoft Group Policy Objects (GPO).

Multi-Factor Authentication (MFA):

- Enforce MFA for all privileged accounts using Duo Security, Okta, or Microsoft Azure AD MFA.

Privileged Access Management (PAM):

- Use PAM solutions like CyberArk, BeyondTrust, or Thycotic to manage, monitor, and audit privileged access.

Auditing and Monitoring:

- Integrate activity monitoring into your SIEM (e.g., Splunk or QRadar) to detect and alert on anomalous privileged account usage.

Just-In-Time Access:

- Deploy JIT solutions like Azure Privileged Identity Management (PIM) or configure ephemeral roles in AWS and GCP to grant time-limited elevated permissions.

*Tools for Implementation*

Privileged Access Management (PAM):

- CyberArk, BeyondTrust, Thycotic, HashiCorp Vault.

Credential Management:

- Microsoft LAPS (Local Admin Password Solution), Password Safe, HashiCorp Vault, KeePass.

Multi-Factor Authentication:

- Duo Security, Okta, Microsoft Azure MFA, Google Authenticator.

Linux Privilege Management:

- sudo configuration, SELinux, AppArmor.

Just-In-Time Access:

- Azure Privileged Identity Management (PIM), AWS IAM Roles with session constraints, GCP Identity-Aware Proxy.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
a45f446ec66144fd...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.2 Current bundle a45f446ec661…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Picus Labs Proc cump 2022

    Huseyin Can YUCEEL & Picus Labs. (2022, March 22). Retrieved March 31, 2023.

    Open source URL
  2. [2]
    baeldung Linux proc map 2022

    baeldung. (2022, April 8). Understanding the Linux /proc/id/maps File. Retrieved March 31, 2023.

    Open source URL
  3. [3]
    atomic-red proc file system

    Atomic Red Team. (2023, November). T1003.007 - OS Credential Dumping: Proc Filesystem. Retrieved March 28, 2024.

    Open source URL
  4. [4]
    MimiPenguin GitHub May 2017

    Gregal, H. (2017, May 12). MimiPenguin. Retrieved December 5, 2017.

    Open source URL
  5. [5]
    Polop Linux PrivEsc Gitbook

    Carlos Polop. (2023, March 5). Linux Privilege Escalation. Retrieved March 31, 2023.

    Open source URL
  6. [6]
    mitre-attack T1003.007
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use