Sudoers file or sudo credential cache altered from a command line

Siemphony@siemphonymediumT1548.003unverified

Matches a process creation whose arguments name the sudoers configuration (`/etc/sudoers` or anything under `/etc/sudoers.d/`), one of the two sudo caching directives MITRE's AN0143 calls out by name (`tty_tickets`, `timestamp_timeout`) or the sudo timestamp store itself (`/var/db/sudo`, `/var/lib/sudo/ts`, `/run/sudo/ts`), together with the `NOPASSWD:` grant that turns a sudo entry into an unauthenticated one. This is the half of AN0142 that a single event can carry: its other log source asks for an execve of sudo where `euid != uid`, and the Linux `process_creation` vocabulary (`Image`, `CommandLine`, `ParentImage`, `User`, `CurrentDirectory`) has no effective-versus-real uid pair to compare, while a selector on sudo alone would match every administrative command on the estate. The read-only filter drops inspection tools such as grep, cat and diff whose only relationship to these paths is reading them, which is discovery rather than this technique. Two blind spots matter more than the coverage: a redirect typed at an interactive prompt (`echo '...' >> /etc/sudoers`) is a shell builtin plus a shell-performed redirect and produces no execve at all, so it is invisible here — only the `sh -c "..."` form used by scripts, Dockerfile `RUN` steps and ssh one-liners is audited — and bare `visudo` with no path argument carries no matching string either. The filter is keyed on `Image`, so a read-only command wrapped in `sh -c` still matches because the audited binary is the shell. `CommandLine` here is a normalised join of the auditd SYSCALL and EXECVE records; a raw auditd feed keeps the arguments in a separate EXECVE record and needs that mapping applied before any selection can match, and auditd does not audit execve by default, so an empty result means the syscall is not being recorded rather than the estate being quiet. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0052, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((ProcessCommandLine contains "/etc/sudoers" or (ProcessCommandLine contains "tty_tickets" or ProcessCommandLine contains "timestamp_timeout" or ProcessCommandLine contains "NOPASSWD:") or (ProcessCommandLine contains "/var/db/sudo" or ProcessCommandLine contains "/var/lib/sudo/ts" or ProcessCommandLine contains "/run/sudo/ts" or ProcessCommandLine contains "/var/run/sudo/ts")) and not ((FolderPath endswith "/grep" or FolderPath endswith "/egrep" or FolderPath endswith "/fgrep" or FolderPath endswith "/cat" or FolderPath endswith "/diff" or FolderPath endswith "/stat" or FolderPath endswith "/ls" or FolderPath endswith "/find" or FolderPath endswith "/md5sum" or FolderPath endswith "/sha256sum")))

Splunk · SPL

Run this as a search.

index=* ((CommandLine="*/etc/sudoers*" OR (CommandLine="*tty_tickets*" OR CommandLine="*timestamp_timeout*" OR CommandLine="*NOPASSWD:*") OR (CommandLine="*/var/db/sudo*" OR CommandLine="*/var/lib/sudo/ts*" OR CommandLine="*/run/sudo/ts*" OR CommandLine="*/var/run/sudo/ts*")) AND NOT ((Image="*/grep" OR Image="*/egrep" OR Image="*/fgrep" OR Image="*/cat" OR Image="*/diff" OR Image="*/stat" OR Image="*/ls" OR Image="*/find" OR Image="*/md5sum" OR Image="*/sha256sum")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.command_line) LIKE "*/etc/sudoers*" OR (TO_LOWER(process.command_line) LIKE "*tty_tickets*" OR TO_LOWER(process.command_line) LIKE "*timestamp_timeout*" OR TO_LOWER(process.command_line) LIKE "*nopasswd:*") OR (TO_LOWER(process.command_line) LIKE "*/var/db/sudo*" OR TO_LOWER(process.command_line) LIKE "*/var/lib/sudo/ts*" OR TO_LOWER(process.command_line) LIKE "*/run/sudo/ts*" OR TO_LOWER(process.command_line) LIKE "*/var/run/sudo/ts*")) AND NOT ((TO_LOWER(process.executable) LIKE "*/grep" OR TO_LOWER(process.executable) LIKE "*/egrep" OR TO_LOWER(process.executable) LIKE "*/fgrep" OR TO_LOWER(process.executable) LIKE "*/cat" OR TO_LOWER(process.executable) LIKE "*/diff" OR TO_LOWER(process.executable) LIKE "*/stat" OR TO_LOWER(process.executable) LIKE "*/ls" OR TO_LOWER(process.executable) LIKE "*/find" OR TO_LOWER(process.executable) LIKE "*/md5sum" OR TO_LOWER(process.executable) LIKE "*/sha256sum")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,linux,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="7">    <!-- Set <if_sid> to the decoder/base rule for linux so this only evaluates relevant events. -->    <field name="CommandLine" type="pcre2">(?i)(/etc/sudoers|(tty_tickets|timestamp_timeout|NOPASSWD:)|(/var/db/sudo|/var/lib/sudo/ts|/run/sudo/ts|/var/run/sudo/ts))</field>    <field name="Image" negate="yes" type="pcre2">(?i)(/grep$|/egrep$|/fgrep$|/cat$|/diff$|/stat$|/ls$|/find$|/md5sum$|/sha256sum$)</field>    <description>Sudoers file or sudo credential cache altered from a command line</description>    <mitre>      <id>T1548.003</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / linux
Level: medium
Category: privilege_escalation_abuse
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: a1294eb5-04d1-4f6d-8e4f-4408a31a9763

ATT&CKT1548.003

T1548.003Sudo and Sudo Caching

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonprivilege escalation abuse

privilege escalation abuseAI draft — unreviewed

01 · What this rule detects

AN0142 asks for two things: an execve of sudo where euid != uid, and an execve that modifies /etc/sudoers or writes /var/db/sudo. Only the second survives into a single-event rule, and that is what was written — a Linux process creation whose command line names the sudoers configuration, a sudo caching directive, or the timestamp store. The first clause was dropped deliberately. The Sigma process_creation/linux vocabulary (Image, CommandLine, ParentImage, User, CurrentDirectory) carries no effective-versus-real uid pair to compare, and a selector on sudo alone matches every administrative command on the estate.

02 · Telemetry you need

The logsource is AN0142's, verbatim: category: process_creation, product: linux. In practice that is auditd execve, and auditd does not audit execve by default — without an -S execve rule the query returns zero rows, which reads as quiet when it means blind.
CommandLine here is assumed to be a normalised join of the SYSCALL and EXECVE records. A raw auditd feed keeps arguments in a separate EXECVE record; apply that mapping first or no selection can match.

03 · How the logic works

Three selections OR'd, one filter subtracted: (1 of selection*) and not filter_read_only. selection_sudoers_path is a single CommandLine|contains: '/etc/sudoers'. The substring covers /etc/sudoers.d/anything for free — no second term needed. selection_caching_directive matches tty_tickets, timestamp_timeout and NOPASSWD:. Attribution matters here: AN0143 names `tty_tickets` and NOPASSWD — but AN0143 is the macOS analytic, whose only log source is macos:unifiedlog, so those strings are being applied across platforms on the grounds that sudoers syntax is shared. timestamp_timeout comes from the technique prose and AN0142's timestamp_timeout_threshold knob; the literal string is the pipeline's own. The trailing colon on NOPASSWD: is authored too, and it is load-bearing — it anchors on the grant as written in a sudoers line rather than on the word appearing in a comment or a filename. selection_timestamp_store lists /var/db/sudo, /var/lib/sudo/ts, /run/sudo/ts and /var/run/sudo/ts. MITRE names /var/db/sudo; that is the macOS and legacy path, retained for those hosts, while modern Linux uses /run/sudo/ts. The rest of the list is the pipeline's. filter_read_only drops grep, egrep, fgrep, cat, diff, stat, ls, find, md5sum and sha256sum — inspection is discovery, not this technique. It keys on Image, and that is its weakness: sh -c 'grep NOPASSWD /etc/sudoers' is audited as the shell and passes straight through, as does sudo cat /etc/sudoers, whose Image is sudo. Two blind spots are structural. A redirect — echo '...' >> /etc/sudoers — is a shell builtin plus a shell-performed redirect and produces no execve at all. That applies to a line typed at a prompt and to the same line inside a downloaded `.sh` file, where the only execve is bash /tmp/x.sh. Bare visudo with no path argument carries no matching string either.

04 · Common false positives

Continuously, on exactly the hosts you would most like to watch. Container image builds and cloud-init provisioning grant service accounts passwordless sudo on every build. Configuration management that renders a drop-in through a shell task rather than a file resource fires on every convergence run. Compliance scanners wrapped in sh -c defeat the read-only filter daily. The rule ships at level: medium; its own top false positive describes a hit per host per run, which argues for low until the sources below are filtered out.

05 · Detection maturity

tier_1: — derived from a MITRE scaffold that contains no query logic, and never executed against a log line. Reasoning on paper that `sed -i`, `tee` and `sudoedit` land in the selections is analysis, not verification, and says nothing about the volume underneath.
tier_2: run read-only for a fortnight and turn the top parents into the filter block.
tier_3: ** pair it with the euid != uid leg from raw auditd and alert on the sequence.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Filter by ParentImage first: ansible, packer, puppet, chef, cloud-init,
Extend the read-only test so it survives a shell or sudo wrapper, or accept
Use AN0143's admin_user_context knob on the User field to separate

Declared by the author

Container image builds and machine provisioning, where a Dockerfile RUN step, a cloud-init runcmd, a Packer or Vagrant shell provisioner grants a build or service account passwordless sudo with a one-liner such as sh -c 'echo deploy ALL=(ALL) NOPASSWD: ALL > /etc/sudoers.d/deploy'. On build and CI hosts this is the loudest match by a wide margin, fires on every image build, and is the reason this rule is not rated higher.
Configuration management that renders a sudoers drop-in through a shell task rather than a file resource — tee /etc/sudoers.d/90-ops, sed -i against /etc/sudoers, or a post-install script from a package that ships its own sudo rules — producing a match on every managed host on every convergence run.
Compliance and audit tooling wrapped in a shell, such as sh -c 'grep -R NOPASSWD /etc/sudoers.d' run by Lynis, OpenSCAP or an osquery scheduled pack: the read-only filter keys on Image and the audited binary here is the shell, so these scans match daily on every host in scope.
Administrators editing the file by explicit path (sudoedit /etc/sudoers, sudo vi /etc/sudoers.d/10-ops) or raising timestamp_timeout to avoid re-prompting during a long maintenance window, which is exactly the change this rule is built to catch and is separated from an intrusion only by who made it and why.

Noise check0 of 4 fired

Fires on none of the 4 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 4 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1548.003, evaluated against their process_creation events.

Share this rule

/u/siemphony/a1294eb5-04d1-4f6d-8e4f-4408a31a9763

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Sudoers file or sudo credential cache altered from a command line

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it