splApache-2.0from splunk/security_content

Linux Auditd Sudo Or Su Execution

The following analytic detects the execution of the "sudo" or "su" command on a Linux operating system. It leverages data from Linux Auditd, focusing on process names and parent process names. This activity is significant because "sudo" and "su" commands are commonly used by adversaries to elevate privileges, potentially leading to unauthorized access or control over the system. If confirmed malicious, this activity could allow attackers to execute commands with root privileges, leading to severe security breaches, data exfiltration, or further system compromise.

Quality

FP risk

—

Forks

Views

Rule sourcedetections/endpoint/linux_auditd_sudo_or_su_execution.yml

`linux_auditd`  proctitle IN ("*sudo *", "*su *")
  | rename host as dest
  | stats count min(_time) as firstTime max(_time) as lastTime
    BY proctitle dest
  | `security_content_ctime(firstTime)`
  | `security_content_ctime(lastTime)`
  | `linux_auditd_sudo_or_su_execution_filter`