Passwd utility executed

Goal

Detect execution of the passwd command.

Strategy

The passwd operating system command is used to change user account passwords. If this is unexpected behavior, it could indicate an attacker attempting to compromise your host machine and achieve persistence. This detection is triggered when execution of the passwd command is detected.

Triage and response

1. Determine which user executed the passwd command and whether or not this is allowed or expected behaviour.
2. If this behaviour is unexpected, attempt to contain the compromise (this may be achieved by terminating the workload, depending on the stage of attack) and look for indications of initial compromise. Follow your organization’s internal processes for investigating and remediating compromised systems.
3. Investigate security signals (if present) occurring around the time of the event to establish an attack path.
4. Find and repair the root cause of the exploit.

Requires Agent version 7.27 or greater