splApache-2.0from splunk/security_content

Linux Auditd Doas Conf File Creation

The following analytic detects the creation of the doas.conf file on a Linux host. This file is used by the doas utility to allow standard users to perform tasks as root, similar to sudo. The detection leverages Linux Auditd data, focusing on the creation of the doas.conf file. This activity is significant because it can indicate an attempt to gain elevated privileges, potentially by an adversary. If confirmed malicious, this could allow an attacker to execute commands with root commands with root privileges, leading to full system compromise.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/linux_auditd_doas_conf_file_creation.yml

`linux_auditd`
(
  (type=PATH nametype="CREATE")
  OR
  type=CWD
)
| rex "msg=audit\([^)]*:(?<audit_id>\d+)\)"

| stats
  values(type) as types
  values(name) as names
  values(nametype) as nametype
  values(cwd) as cwd_list
  values(_time) as event_times
  by audit_id host

| eval current_working_directory = coalesce(mvindex(cwd_list, 0), "N/A")
| eval candidate_paths = mvmap(names, if(match(names, "^/"), names, current_working_directory + "/" + names))
| eval matched_paths = mvfilter(match(candidate_paths, "/etc/doas.conf.*"))
| eval match_count = mvcount(matched_paths)
| eval reconstructed_path = mvindex(matched_paths, 0)
| eval e_time = mvindex(event_times, 0)
| where match_count > 0
| rename host as dest

| stats count min(e_time) as firstTime max(e_time) as lastTime
  values(nametype) as nametype
  by current_working_directory
     reconstructed_path
     match_count
     dest
     audit_id

| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| table nametype current_working_directory reconstructed_path dest audit_id match_count firstTime lastTime
| `linux_auditd_doas_conf_file_creation_filter`