Elastic low stable eql

Passwordless Sudo Probing

This rule detects passwordless sudo probing activity on Linux systems. Passwordless sudo probing can be an indication of an attacker attempting to enumerate it's allowed commands and potential privilege escalation.

View Source

Detection Logic

process where host.os.type == "linux" and event.type == "start" and
event.action in ("exec", "exec_event", "start", "ProcessRollup2", "executed", "process_started") and
process.name == "sudo" and process.args in ("-n", "--non-interactive") and process.args == "true"

Field Validations

Loading…

Comments (0)

Loading comments...