Linux Auditd Possible Access To Sudoers File

splApache-2.0from splunk/security_content

The following analytic detects potential access or modification of the /etc/sudoers file on a Linux system. It leverages data from Linux Auditd, focusing on events of type PATH or CWD. This activity could be significant because the sudoers file controls user permissions for executing commands with elevated privileges. Correlate this with related EXECVE or PROCTITLE events to identify the process or user responsible for the access or modification. If confirmed malicious, an attacker could gain persistence or escalate privileges, compromising the security of the targeted host.