Copy Passwd Or Shadow From TMP Path — Detection Rule

Detects when the file "passwd" or "shadow" is copied from tmp path

Read the full analysis on IntelFusions