Sudoers policy file modified
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Goal
Detect modifications to /etc/sudoers policy file.
Strategy
Sudo allows users to perform commands from terminals with delegated authority to give certain users (or groups of users) the ability to run some (or all) commands as root. The sudoers policy file, /etc/sudoers, describes which users can run commands with root level privileges using sudo. Adversaries may attempt to edit the sudoers policy file to execute commands as other users or to spawn processes with higher privileges.
Triage and response
- Identify if the changes to the path
{{@file.path}} were part of known system setup or maintenance. - If these changes were unauthorized, roll back the host in question to a known good sudoers policy file, or replace the system with a known good system image.
Requires Agent version 7.27 or greater.
