name: Linux Sudo OR Su Execution
id: 4b00f134-6d6a-11ec-a90c-acde48001122
version: 1
date: '2022-01-04'
author: Teoderick Contreras, Splunk
type: Hunting
datamodel:
- Endpoint
description: This analytic is to detect the execution of sudo or su command in linux
  operating system. The "sudo" command allows a system administrator to delegate authority
  to give certain users (or groups of users) the ability to run some (or all) commands
  as root or another user while providing an audit trail of the commands and their
  arguments. This command is commonly abused by adversaries, malware author and red
  teamers to elevate privileges to the targeted host. This command can be executed
  by administrator for legitimate purposes or to execute process that need admin privileges,
  In this scenario filter is needed.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
  as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("sudo",
  "su") OR Processes.parent_process_name IN ("sudo", "su") by Processes.dest Processes.user
  Processes.parent_process_name Processes.process_name Processes.process Processes.process_id
  Processes.parent_process_id Processes.process_guid | `drop_dm_object_name(Processes)`
  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_sudo_or_su_execution_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. If you are
  using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can execute this command.
  Please update the filter macros to remove false positives.
references:
- https://attack.mitre.org/techniques/T1548/003/
tags:
  analytic_story:
  - Linux Privilege Escalation
  - Linux Persistence Techniques
  automated_detection_testing: passed
  cis20:
  - CIS 3
  - CIS 5
  - CIS 16
  confidence: 30
  context:
  - Source:Endpoint
  - Stage:Privilege Escalation
  - Stage:Persistence
  dataset:
  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudo_su/sysmon_linux.log
  impact: 30
  kill_chain_phases:
  - Exploitation
  message: A commandline $process$ that execute sudo or su in $dest$
  mitre_attack_id:
  - T1548.003
  - T1548
  nist:
  - DE.CM
  observable:
  - name: dest
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  required_fields:
  - _time
  - Processes.dest
  - Processes.user
  - Processes.parent_process_name
  - Processes.process_name
  - Processes.process
  - Processes.process_id
  - Processes.parent_process_id
  risk_score: 9
  security_domain: endpoint
  asset_type: Endpoint