From ef99a8c8bc819992cd482ba7e8c3de88b33f231d Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Mon, 10 Jan 2022 12:36:33 +0100 Subject: [PATCH] Update linux_sudoers_tmp_file_creation.yml --- detections/endpoint/linux_sudoers_tmp_file_creation.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml index 958963ce45..ab7f1f44e0 100644 --- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml +++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Endpoint description: This analytic is to looks for file creation of sudoers.tmp file cause - by editing /etc/sudoers using visudo in linux platform. This technique may abuse + by editing /etc/sudoers using visudo or editor in linux platform. This technique may abuse by adversaries, malware author and red teamers to gain elevated privilege to targeted or compromised host. /etc/sudoers file controls who can run what commands as what users on what machines and can also control special things such as whether you need