What happened

The sudoers policy {{ @file.path }} was modified by {{ @process.comm }}, potentially to escalate privileges.

Goal

Detect modifications to /etc/sudoers policy file.

Strategy

Sudo allows users to perform commands from terminals with delegated authority to give certain users (or groups of users) the ability to run some (or all) commands as root. The sudoers policy file, /etc/sudoers, describes which users can run commands with root level privileges using sudo. Adversaries may attempt to edit the sudoers policy file to execute commands as other users or to spawn processes with higher privileges.

Triage and response

1. Identify if the changes to the path {{@file.path}} were part of known system setup or maintenance.
2. If these changes were unauthorized, roll back the host in question to a known good sudoers policy file, or replace the system with a known good system image.

Requires Agent version 7.27 or greater.