Linux doas Tool Execution (Process Creation)

title: Linux doas Tool Execution (Process Creation)
id: 961fa300-5f7e-4932-a78e-9fad1d6f0201
status: stable
description: This rule identifies execution of the doas utility on Linux hosts by matching process image paths ending with /doas. Because doas can run commands as root for standard users, attackers may use it to bypass tighter controls compared to sudo. The detection relies on Linux process creation telemetry, specifically the executable path recorded for each new process.
references:
  - https://research.splunk.com/endpoint/linux_doas_tool_execution/
  - https://www.makeuseof.com/how-to-install-and-use-doas/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_doas_execution.yml
author: Sittikorn S, Teoderick Contreras, Huntrule Team
date: 2022-01-20
tags:
  - attack.privilege-escalation
  - attack.t1548
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /doas
  condition: selection
falsepositives:
  - Unlikely
level: low
license: DRL-1.1
related:
  - id: 067d8238-7127-451c-a9ec-fa78045b618b
    type: derived