From 3d75e6df5215f343c03eee61ced10aceead55c60 Mon Sep 17 00:00:00 2001
From: root <root@ip-10-0-43-64>
Date: Wed, 12 Jan 2022 09:22:22 +0000
Subject: [PATCH] Added detection testing service results inLinux NOPASSWD
 Entry In Sudoers File

---
 .../linux_nopasswd_entry_in_sudoers_file.yml  | 45 ++++++++++---------
 1 file changed, 24 insertions(+), 21 deletions(-)

diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
index e8db981a4c..3521fc6afb 100644
--- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
+++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml
@@ -6,22 +6,25 @@ author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
 - Endpoint
-description: This analytic is to look for suspicious command lines that may add entry to /etc/sudoers with NOPASSWD attribute in linux platform.
-  This technique is commonly abuse by adversaries, malware author and red teamers to gain elevated privilege to the targeted or compromised host. 
-  /etc/sudoers file controls who can run what commands users can execute on the machines and can also control whether user need a password to execute particular commands. 
-  This file is composed of aliases (basically variables) and user specifications.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
-  where Processes.process = "*NOPASSWD:*" 
-  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
-  | `drop_dm_object_name(Processes)` 
-  | `security_content_ctime(firstTime)` 
-  | `security_content_ctime(lastTime)`
+description: This analytic is to look for suspicious command lines that may add entry
+  to /etc/sudoers with NOPASSWD attribute in linux platform. This technique is commonly
+  abuse by adversaries, malware author and red teamers to gain elevated privilege
+  to the targeted or compromised host. /etc/sudoers file controls who can run what
+  commands users can execute on the machines and can also control whether user need
+  a password to execute particular commands. This file is composed of aliases (basically
+  variables) and user specifications.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process = "*NOPASSWD:*"
+  by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
+  Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
   | `linux_nopasswd_entry_in_sudoers_file_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
-  Sysmon TA. 
-known_false_positives: administrator or network operator can execute this command. filter is needed 
+  Sysmon TA.
+known_false_positives: administrator or network operator can execute this command.
+  filter is needed
 references:
 - https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands
 - https://help.ubuntu.com/community/Sudoers
@@ -42,18 +45,17 @@ tags:
   - Splunk Cloud
   required_fields:
   - _time
-  - Processes.dest 
-  - Processes.user 
-  - Processes.parent_process_name 
-  - Processes.process_name 
-  - Processes.process 
-  - Processes.process_id 
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
   - Processes.parent_process_id
   security_domain: endpoint
   impact: 80
-  confidence: 80 
-  # (impact * confidence)/100
-  risk_score: 64 
+  confidence: 80
+  risk_score: 64
   context:
   - source:endpoint
   - stage:Privilege Escalation
@@ -70,3 +72,4 @@ tags:
   - CIS 3
   - CIS 5
   - CIS 16
+  automated_detection_testing: passed