Hunt: Linux Process Heap Dump via /proc/pid/mem and dd

Danny Y@zendannyy

•updated Jun 29, 2026•0•0•5

Hunting rule for Linux procfs heap credential harvesting: resolve a target PID (pgrep), locate the heap mapping in /proc/<pid>/maps, then copy a bounded region from /proc/<pid>/mem with dd (ibs=1 skip= count=). Matches Atomic Red Team T1003.007 "Dump individual process memory with sh (Local)". Prioritize output under /tmp, /var/tmp, or /dev/shm and parent shells that are not debuggers or crash-analysis tooling.