name: Linux Sudo OR Su Execution
id: 4b00f134-6d6a-11ec-a90c-acde48001122
version: 1
date: '2022-01-04'
author: Teoderick Contreras, Splunk
status: production
type: Hunting
description: This analytic is to detect the execution of sudo or su command in linux
  operating system. The "sudo" command allows a system administrator to delegate authority
  to give certain users (or groups of users) the ability to run some (or all) commands
  as root or another user while providing an audit trail of the commands and their
  arguments. This command is commonly abused by adversaries, malware author and red
  teamers to elevate privileges to the targeted host. This command can be executed
  by administrator for legitimate purposes or to execute process that need admin privileges,
  In this scenario filter is needed.
data_source:
- Sysmon Event ID 1
search:
  selection1:
    ParentImage:
    - sudo
    - su
  selection2:
    Image|endswith:
    - sudo
    - su
  condition: selection1 or selection2
how_to_implement: To successfully implement this search you need to be ingesting information
  on process that include the name of the process responsible for the changes from
  your endpoints into the `Endpoint` datamodel in the `Processes` node. If you are
  using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.
known_false_positives: Administrator or network operator can execute this command.
  Please update the filter macros to remove false positives.
references:
- https://attack.mitre.org/techniques/T1548/003/
tags:
  analytic_story:
  - Linux Privilege Escalation
  - Linux Persistence Techniques
  asset_type: Endpoint
  confidence: 30
  impact: 30
  message: A commandline $process$ that execute sudo or su in $dest$
  mitre_attack_id:
  - T1548.003
  - T1548
  observable:
  - name: dest
    type: Hostname
    role:
    - Victim
  product:
  - Splunk Enterprise
  - Splunk Enterprise Security
  - Splunk Cloud
  risk_score: 9
  security_domain: endpoint
tests:
- name: True Positive Test
  attack_data:
  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudo_su/sysmon_linux.log
    source: Syslog:Linux-Sysmon/Operational
    sourcetype: sysmon:linux