Proc Filesystem

ATT&CK T1003.007

Adversaries may gather credentials from the proc filesystem or `/proc`. The proc filesystem is a pseudo-filesystem used as an interface to kernel data structures for Linux based systems managing virtual memory. For each process, the `/proc/<PID>/maps` file shows how memory is mapped within the process’s virtual address space. And `/proc/<PID>/mem`, exposed for debugging purposes, provides access to the process’s virtual address space.(Citation: Picus Labs Proc cump 2022)(Citation: baeldung Linux proc map 2022) When executing with root privileges, adversaries can search these memory locations f

Category: Technique, credential-access

MITRE ATT&CK: T1003.007

Reference: MITRE ATT&CK T1003.007