splunk-security_content/docs/_posts/2021-12-23-linux_sudoers_tmp_file_creation.md

title, excerpt, categories, last_modified_at, toc, toc_label, tags

title	excerpt	categories	last_modified_at	toc	toc_label	tags
Linux Sudoers Tmp File Creation	Sudo and Sudo Caching , Abuse Elevation Control Mechanism	Endpoint	2021-12-23	true		Sudo and Sudo Caching Abuse Elevation Control Mechanism Defense Evasion Privilege Escalation Defense Evasion Privilege Escalation Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint

Try in Splunk Security Cloud{: .btn .btn--success}

Description

This analytic is to looks for file creation of sudoers.tmp file cause by editing /etc/sudoers using visudo or editor in linux platform. This technique may abuse by adversaries, malware author and red teamers to gain elevated privilege to targeted or compromised host. /etc/sudoers file controls who can run what commands as what users on what machines and can also control special things such as whether you need a password for particular commands. The file is composed of aliases (basically variables) and user specifications (which control who can run what).

• Type: Anomaly
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2021-12-23
• Author: Teoderick Contreras, Splunk
• ID: be254a5c-63e7-11ec-89da-acde48001122

Annotations

ATT&CK

ID	Technique	Tactic
T1548.003	Sudo and Sudo Caching	Defense Evasion, Privilege Escalation

| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |

Kill Chain Phase

• Exploitation

NIST

• DE.CM

CIS20

• CIS 3
• CIS 5
• CIS 16

CVE

Search

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*sudoers.tmp*") by Filesystem.dest Filesystem.file_name Filesystem.process_guid Filesystem.file_path 
| `drop_dm_object_name(Filesystem)` 
| `security_content_ctime(lastTime)` 
| `security_content_ctime(firstTime)` 
| `linux_sudoers_tmp_file_creation_filter`

Macros

The SPL above uses the following Macros:

• security_content_summariesonly
• security_content_ctime

Note that linux_sudoers_tmp_file_creation_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required field

• _time
• Filesystem.dest
• Filesystem.file_create_time
• Filesystem.file_name
• Filesystem.process_guid
• Filesystem.file_path

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.

Known False Positives

administrator or network operator can execute this command. Please update the filter macros to remove false positives.

Associated Analytic story

• Linux Privilege Escalation
• Linux Persistence Techniques

RBA

Risk Score	Impact	Confidence	Message
72.0	80	90	A file file_name is created in file_path on dest

Reference

• https://forum.ubuntuusers.de/topic/sudo-visudo-gibt-etc-sudoers-tmp/

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

• https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log

source | version: 1