Elastic medium stable eql

Potential Defense Evasion via Doas

This rule detects the creation or rename of the Doas configuration file on a Linux system. Adversaries may create or modify the Doas configuration file to elevate privileges and execute commands as other users while attempting to evade detection.

View Source

Detection Logic

file where host.os.type == "linux" and event.type != "deletion" and file.path == "/etc/doas.conf"

Field Validations

Loading…

Comments (0)

Loading comments...