value:  Ransomware such as SODINOKIBI will attempt to dump hashed files from the /etc/passwd directory for offline breaking as they are easier to acquire than the shadow directory. 
name: OS Credential Dumping: /Etc/Passwd And /Etc/Shadow