SignalHunt
← All rules

LIN-2002

medium

Suspicious Sudo Command Execution

Detects sudo invocations of common privilege-escalation / discovery tooling (e.g. shells, package managers used to drop binaries) that don't match routine admin activity - a coarse but useful first pass on sudo abuse.

T1548.003T1078.003

Detection logic

{
  "detection_type": "selection",
  "selection": {
    "process": "sudo",
    "action": "command"
  }
}

Log source: product=linux, service=auth · Event ID(s): sudo_command

Required log fields

  • user
  • target_user
  • command
  • tty

Enabling this in your environment

Where: /etc/sudoers, /etc/audit/rules.d/

auditctl -w /etc/sudoers -p wa -k sudoers_changes auditctl -a always,exit -F arch=b64 -S execve -F euid=0 -k root_exec

Sudo already logs "COMMAND=" lines to /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL) by default. For richer fields (full argv, TTY, working directory) enable auditd rules above so `command` and `tty` are populated for correlation, not just the raw syslog line.

False positives

  • Legitimate admin scripts run interactively via sudo

References