Proc Filesystem
Subtechnique · ATTACK:enterprise:T1003.007
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1003.007",
"title": "Proc Filesystem",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1003/007",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--3120b9fa-23b8-4500-ae73-09494f607b7d",
"external_id": "T1003.007",
"domain": "enterprise",
"created": "2020-02-11T18:46:24.434Z",
"modified": "2025-10-24T17:48:36.165Z",
"version": "1.2",
"aliases": [
],
"tactics": [
"credential-access"
],
"source_references": [
{
"source_name": "atomic-red proc file system",
"url": "https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.007/T1003.007.md"
},
{
"source_name": "baeldung Linux proc map 2022",
"url": "https://www.baeldung.com/linux/proc-id-maps"
},
{
"source_name": "Polop Linux PrivEsc Gitbook",
"url": "https://book.hacktricks.xyz/linux-hardening/privilege-escalation#proc-usdpid-maps-and-proc-usdpid-mem"
},
{
"source_name": "MimiPenguin GitHub May 2017",
"url": "https://github.com/huntergregal/mimipenguin"
},
{
"source_name": "Picus Labs Proc cump 2022",
"url": "https://www.picussecurity.com/resource/the-mitre-attck-t1003-os-credential-dumping-technique-and-its-adversary-use"
}
]
}Explicit source assertions (8)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1003.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--22d9e88d-fbcc-4e5e-a253-9b74a573fbd2
Flashpoint Mini Shai-Hulud MAY 2026ATTACK:enterprise:S1109 → uses → ATTACK:enterprise:T1003.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--251e58cb-cd9d-49d3-81bf-b3db94b50375
Mandiant Pulse Secure Zero-Day April 2021ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1003.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7e3d1339-90a7-4fc6-b742-4229f3e76b97
ATTACK:enterprise:S9041 → uses → ATTACK:enterprise:T1003.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8775a470-084f-490e-8d8d-f21a8e2f8188
Aqua Security Trivy Compromise MAR 2026 · Aqua Security Blog Trivy Compromise APR 2026 · Wiz Trivy Compromise MAR 2026 · Wiz TeamPCP KICS MAR 2026 · Sysdig TeamPCP MAR 2026 · Palo Alto TeamPCP MAR 2026ATTACK:enterprise:T1003.007 → subtechnique-of → ATTACK:enterprise:T1003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a9ad8c47-9cec-45c1-8d07-6154d2cc752b
ATTACK:enterprise:S0349 → uses → ATTACK:enterprise:T1003.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bb9706eb-de51-4200-ac38-d7d658f90ea9
Picus Labs Proc cump 2022 · GitHub LaZagne Dec 2018ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1003.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d039cf20-a85b-4179-b164-6200decb9bd8
ATTACK:enterprise:S0179 → uses → ATTACK:enterprise:T1003.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3b810ed-0be4-448b-b1ac-aa3a7dd16c91
MimiPenguin GitHub May 2017 · Picus Labs Proc cump 2022