Skip to content

[New Rule] Sudo Command Enumeration Detected #2946

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 8 commits into from
Aug 3, 2023
Merged

[New Rule] Sudo Command Enumeration Detected #2946

merged 8 commits into from
Aug 3, 2023

Conversation

Aegrah
Copy link
Contributor

@Aegrah Aegrah commented Jul 20, 2023 •
edited
Loading

Summary

This rule monitors for the usage of the sudo -l command, which is used to list the allowed and forbidden commands for the invoking user. Attackers may execute this command to enumerate commands allowed to be executed with sudo permissions, potentially allowing to escalate privileges to root.

Detection

process where host.os.type == "linux" and event.type == "start" and event.action == "exec" and 
process.name == "sudo" and process.args == "-l" and 
process.parent.name : ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and 
not group.Ext.real.id : "0" and not user.Ext.real.id : "0"
image

Ran the query in RedSector, as I thought it could potentially be noisy due to system administrators running the command. Only 1 TP in redsector in the last 120 days:

image

@Aegrah Aegrah self-assigned this Jul 20, 2023
@Aegrah Aegrah mentioned this pull request Jul 24, 2023
Closed
@Aegrah Aegrah removed the v8.9.0 label Jul 25, 2023
brokensound77
brokensound77 reviewed Aug 2, 2023
View reviewed changes
brokensound77
brokensound77 reviewed Aug 2, 2023
View reviewed changes
brokensound77
brokensound77 approved these changes Aug 2, 2023
View reviewed changes
Copy link
Contributor

@brokensound77 brokensound77 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@Aegrah Aegrah merged commit 18c2214 into main Aug 3, 2023
@Aegrah Aegrah deleted the new-rule-sudo-permission-discovery branch August 3, 2023 07:39
protectionsmachine pushed a commit that referenced this pull request Aug 3, 2023
@Aegrah @github-actions
[New Rule] Sudo Command Enumeration Detected (#2946)
7ee8794 
* [New Rule] Sudo Command Enumeration Detected

* Update discovery_sudo_allowed_command_enumeration.toml

* revert endgame support due to unit testing fail

* Update discovery_sudo_allowed_command_enumeration.toml

* Update discovery_sudo_allowed_command_enumeration.toml

* Update rules/linux/discovery_sudo_allowed_command_enumeration.toml

Co-authored-by: Justin Ibarra <[email protected]>

* Update rules/linux/discovery_sudo_allowed_command_enumeration.toml

Co-authored-by: Justin Ibarra <[email protected]>

---------

Co-authored-by: Justin Ibarra <[email protected]>

(cherry picked from commit 18c2214)
protectionsmachine pushed a commit that referenced this pull request Aug 3, 2023
@Aegrah @github-actions
[New Rule] Sudo Command Enumeration Detected (#2946)
bdbfaca 
* [New Rule] Sudo Command Enumeration Detected

* Update discovery_sudo_allowed_command_enumeration.toml

* revert endgame support due to unit testing fail

* Update discovery_sudo_allowed_command_enumeration.toml

* Update discovery_sudo_allowed_command_enumeration.toml

* Update rules/linux/discovery_sudo_allowed_command_enumeration.toml

Co-authored-by: Justin Ibarra <[email protected]>

* Update rules/linux/discovery_sudo_allowed_command_enumeration.toml

Co-authored-by: Justin Ibarra <[email protected]>

---------

Co-authored-by: Justin Ibarra <[email protected]>

(cherry picked from commit 18c2214)
protectionsmachine pushed a commit that referenced this pull request Aug 3, 2023
@Aegrah @github-actions
[New Rule] Sudo Command Enumeration Detected (#2946)
01a2f3a 
* [New Rule] Sudo Command Enumeration Detected

* Update discovery_sudo_allowed_command_enumeration.toml

* revert endgame support due to unit testing fail

* Update discovery_sudo_allowed_command_enumeration.toml

* Update discovery_sudo_allowed_command_enumeration.toml

* Update rules/linux/discovery_sudo_allowed_command_enumeration.toml

Co-authored-by: Justin Ibarra <[email protected]>

* Update rules/linux/discovery_sudo_allowed_command_enumeration.toml

Co-authored-by: Justin Ibarra <[email protected]>

---------

Co-authored-by: Justin Ibarra <[email protected]>

(cherry picked from commit 18c2214)
protectionsmachine pushed a commit that referenced this pull request Aug 3, 2023
@Aegrah @github-actions
[New Rule] Sudo Command Enumeration Detected (#2946)
ee774b3 
* [New Rule] Sudo Command Enumeration Detected

* Update discovery_sudo_allowed_command_enumeration.toml

* revert endgame support due to unit testing fail

* Update discovery_sudo_allowed_command_enumeration.toml

* Update discovery_sudo_allowed_command_enumeration.toml

* Update rules/linux/discovery_sudo_allowed_command_enumeration.toml

Co-authored-by: Justin Ibarra <[email protected]>

* Update rules/linux/discovery_sudo_allowed_command_enumeration.toml

Co-authored-by: Justin Ibarra <[email protected]>

---------

Co-authored-by: Justin Ibarra <[email protected]>

(cherry picked from commit 18c2214)
protectionsmachine pushed a commit that referenced this pull request Aug 3, 2023
@Aegrah @github-actions
[New Rule] Sudo Command Enumeration Detected (#2946)
794bfd7 
* [New Rule] Sudo Command Enumeration Detected

* Update discovery_sudo_allowed_command_enumeration.toml

* revert endgame support due to unit testing fail

* Update discovery_sudo_allowed_command_enumeration.toml

* Update discovery_sudo_allowed_command_enumeration.toml

* Update rules/linux/discovery_sudo_allowed_command_enumeration.toml

Co-authored-by: Justin Ibarra <[email protected]>

* Update rules/linux/discovery_sudo_allowed_command_enumeration.toml

Co-authored-by: Justin Ibarra <[email protected]>

---------

Co-authored-by: Justin Ibarra <[email protected]>

(cherry picked from commit 18c2214)
protectionsmachine pushed a commit that referenced this pull request Aug 3, 2023
@Aegrah @github-actions
[New Rule] Sudo Command Enumeration Detected (#2946)
a1bb3a5 
* [New Rule] Sudo Command Enumeration Detected

* Update discovery_sudo_allowed_command_enumeration.toml

* revert endgame support due to unit testing fail

* Update discovery_sudo_allowed_command_enumeration.toml

* Update discovery_sudo_allowed_command_enumeration.toml

* Update rules/linux/discovery_sudo_allowed_command_enumeration.toml

Co-authored-by: Justin Ibarra <[email protected]>

* Update rules/linux/discovery_sudo_allowed_command_enumeration.toml

Co-authored-by: Justin Ibarra <[email protected]>

---------

Co-authored-by: Justin Ibarra <[email protected]>

(cherry picked from commit 18c2214)
protectionsmachine pushed a commit that referenced this pull request Aug 3, 2023
@Aegrah @github-actions
[New Rule] Sudo Command Enumeration Detected (#2946)
269e6b0 
* [New Rule] Sudo Command Enumeration Detected

* Update discovery_sudo_allowed_command_enumeration.toml

* revert endgame support due to unit testing fail

* Update discovery_sudo_allowed_command_enumeration.toml

* Update discovery_sudo_allowed_command_enumeration.toml

* Update rules/linux/discovery_sudo_allowed_command_enumeration.toml

Co-authored-by: Justin Ibarra <[email protected]>

* Update rules/linux/discovery_sudo_allowed_command_enumeration.toml

Co-authored-by: Justin Ibarra <[email protected]>

---------

Co-authored-by: Justin Ibarra <[email protected]>

(cherry picked from commit 18c2214)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@brokensound77 brokensound77 brokensound77 approved these changes

@w0rk3r w0rk3r w0rk3r approved these changes

@imays11 imays11 Awaiting requested review from imays11

@shashank-elastic shashank-elastic Awaiting requested review from shashank-elastic

@eric-forte-elastic eric-forte-elastic Awaiting requested review from eric-forte-elastic

Assignees

@Aegrah Aegrah

Labels
backport: auto Domain: Endpoint OS: Linux Rule: New Proposal for new rule
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@Aegrah @brokensound77 @w0rk3r