splunk-security_content/docs/_posts/2021-12-21-linux_visudo_utility_execution.md

title, excerpt, categories, last_modified_at, toc, toc_label, tags

title	excerpt	categories	last_modified_at	toc	toc_label	tags
Linux Visudo Utility Execution	Sudo and Sudo Caching , Abuse Elevation Control Mechanism	Endpoint	2021-12-21	true		Sudo and Sudo Caching Abuse Elevation Control Mechanism Defense Evasion Privilege Escalation Defense Evasion Privilege Escalation Splunk Enterprise Splunk Enterprise Security Splunk Cloud Endpoint

Try in Splunk Security Cloud{: .btn .btn--success}

Description

This analytic is to looks for suspicious commandline that add entry to /etc/sudoers by using visudo utility tool in linux platform. This technique may abuse by adversaries, malware author and red teamers to gain elevated privilege to targeted or compromised host. /etc/sudoers file controls who can run what commands as what users on what machines and can also control special things such as whether you need a password for particular commands. The file is composed of aliases (basically variables) and user specifications (which control who can run what).

• Type: Anomaly
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Endpoint
• Last Updated: 2021-12-21
• Author: Teoderick Contreras, Splunk
• ID: 08c41040-624c-11ec-a71f-acde48001122

Annotations

ATT&CK

ID	Technique	Tactic
T1548.003	Sudo and Sudo Caching	Defense Evasion, Privilege Escalation

| T1548 | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |

Kill Chain Phase

• Exploitation

NIST

• DE.CM

CIS20

• CIS 3
• CIS 5
• CIS 16

CVE

Search

| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = visudo by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid 
| `drop_dm_object_name(Processes)` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `linux_visudo_utility_execution_filter`

Macros

The SPL above uses the following Macros:

• security_content_summariesonly
• security_content_ctime

Note that linux_visudo_utility_execution_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required field

• _time
• Processes.dest
• Processes.user
• Processes.parent_process_name
• Processes.process_name
• Processes.process
• Processes.process_id
• Processes.parent_process_id

How To Implement

To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from Splunkbase.

Known False Positives

Administrator or network operator can execute this command. Please update the filter macros to remove false positives.

Associated Analytic story

• Linux Privilege Escalation
• Linux Persistence Techniques

RBA

Risk Score	Impact	Confidence	Message
16.0	40	40	A commandline process executed on dest

Reference

• https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

• https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/visudo/sysmon_linux.log

source | version: 1