WARNING: This rule is being deprecated on 30 March 2026.

This rule, which signaled risky behaviors used by attackers and normal operations, is being deprecated as a standalone signal. The behavior is now correlated with other events to ensure continued detection of attackers. Individual risky behaviors are now surfaced as prioritized findings to help improve security posture.

What happened

The sudoers policy {{ @file.path }} was modified by {{ @process.comm }}, potentially to escalate privileges.

Goal

Detect modifications to /etc/sudoers policy file.

Strategy

Sudo allows users to perform commands from terminals with delegated authority to give certain users (or groups of users) the ability to run some (or all) commands as root. The sudoers policy file, /etc/sudoers, describes which users can run commands with root level privileges using sudo. Adversaries may attempt to edit the sudoers policy file to execute commands as other users or to spawn processes with higher privileges.

Triage and response

1. Identify if the changes to the path {{@file.path}} were part of known system setup or maintenance.
2. If these changes were unauthorized, roll back the host in question to a known good sudoers policy file, or replace the system with a known good system image.

Requires Agent version 7.27 or greater.