Sigma low stable sigma

Linux Doas Tool Execution

Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.

View Source

Detection Logic

{
  "selection": {
    "Image
| endswith": "/doas"
  },
  "condition": "selection"
}

False Positives

  • ⚠ Unlikely

Field Validations

Loading…

Comments (0)

Loading comments...