Techniques › T1555.005 › AN1642
AN1642 Analytic 1642
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Suspicious access to password manager vaults (KeePassXC, gnome-keyring, pass) via memory scraping or unauthorized file reads. Detects unusual command execution involving gdb/strace attached to password manager processes.</p>
- Detects
- T1555.005 Password Managers
- Part of
- DET0597 Detect Unauthorized Access to Password Managers
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | open/read on ~/.local/share/keepassxc/* OR ~/.password-store/* | DC0055 File Access |
| auditd:SYSCALL | ptrace | DC0035 Process Access |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
VaultFilePaths | Linux paths to monitor for vault database files (KeePassXC, pass, gnome-keyring). |
TimeWindow | Correlation interval to detect multiple suspicious access events. |