Sunturai
Back to results
InformationalSplunk security contentTeoderick Contreras +1

Linux Auditd Doas Tool Execution

The following analytic detects the execution of the 'doas' tool on a Linux host. This tool allows standard users to perform tasks with root privileges, similar to 'sudo'. The detection leverages data from Linux…

Description

The following analytic detects the execution of the 'doas' tool on a Linux host. This tool allows standard users to perform tasks with root privileges, similar to 'sudo'. The detection leverages data from Linux Auditd, focusing on process names and command-line executions. This activity is significant as 'doas' can be exploited by adversaries to gain elevated privileges on a compromised host. If confirmed malicious, this could lead to unauthorized administrative access, potentially compromising the entire system.

Detection logic

Detection requirements

Platform
LinuxmacOS

The rule states no platform. This is derived from the ATT&CK technique it maps to.

Log source category
linux_auditd_syscall

Known benign triggers

  • Administrator or network operator can execute this command. Please update the filter macros to remove false positives.

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice