Linux doas.conf File Creation

title: Linux doas.conf File Creation
id: 6beaf34c-b15a-434e-9fc8-186357065ccf
status: stable
description: This rule flags file creation events where the target filename ends with /etc/doas.conf on Linux. Attackers and administrators may place this configuration file to enable or adjust doas-based privilege behaviors, making unauthorized changes a high-signal indication. The detection relies on Linux file event telemetry that records the created/target path for files.
references:
  - https://research.splunk.com/endpoint/linux_doas_conf_file_creation/
  - https://www.makeuseof.com/how-to-install-and-use-doas/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/file_event/file_event_lnx_doas_conf_creation.yml
author: Sittikorn S, Teoderick Contreras, Huntrule Team
date: 2022-01-20
modified: 2022-12-31
tags:
  - attack.privilege-escalation
  - attack.t1548
logsource:
  product: linux
  category: file_event
detection:
  selection:
    TargetFilename|endswith: /etc/doas.conf
  condition: selection
falsepositives:
  - Unlikely
level: medium
license: DRL-1.1
related:
  - id: 00eee2a5-fdb0-4746-a21d-e43fbdea5681
    type: derived