Copy Passwd Or Shadow From TMP Path (fa4aaed5-4fe0-498d-bbc0-08e3346387ba)

Detects when the file "passwd" or "shadow" is copied from tmp path

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Copy Passwd Or Shadow From TMP Path (fa4aaed5-4fe0-498d-bbc0-08e3346387ba)	Sigma-Rules	Credentials In Files - T1552.001 (837f9164-50af-4ac0-8219-379d8a74cefc)	Attack Pattern	1
Unsecured Credentials - T1552 (435dfb86-2697-4867-85b5-2fef496c0517)	Attack Pattern	Credentials In Files - T1552.001 (837f9164-50af-4ac0-8219-379d8a74cefc)	Attack Pattern	2