admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update linux_sudoers_tmp_file_creation.yml

Browse Source
This commit is contained in:
tccontre
2022-01-10 12:36:33 +01:00
committed by GitHub
parent 9bcad3d21b
commit ef99a8c8bc
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/linux_sudoers_tmp_file_creation.yml
+1 -1
View File
@@ -7,7 +7,7 @@ type: Anomaly
datamodel:
- Endpoint
description: This analytic is to looks for file creation of sudoers.tmp file cause
by editing /etc/sudoers using visudo in linux platform. This technique may abuse
by editing /etc/sudoers using visudo or editor in linux platform. This technique may abuse
by adversaries, malware author and red teamers to gain elevated privilege to targeted
or compromised host. /etc/sudoers file controls who can run what commands as what
users on what machines and can also control special things such as whether you need