Linux: Reading /etc/sudoers via file content inspection utilities

Alerts on Linux process executions that use common text tools to access /etc/sudoers content.

FreeUnreviewedSigmamediumv1

linux-reading-etc-sudoers-via-file-content-inspection-utilities-0f79c4d2

title: "Linux: Reading /etc/sudoers via file content inspection utilities"
id: 4442855f-31b5-4912-bbca-e4697fafc786
status: test
description: This rule flags process executions where a text-based viewing/editing/grep utility is invoked and the command line includes a reference to /etc/sudoers. Attackers may read this file to identify users or groups with sudo privileges for later privilege escalation or targeting. Detection relies on Linux process creation telemetry capturing the executable path and command line arguments.
references:
  - https://github.com/sleventyeleven/linuxprivchecker/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_process_reading_sudoers.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-20
modified: 2025-06-04
tags:
  - attack.reconnaissance
  - attack.t1592.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - /cat
      - /ed
      - /egrep
      - /emacs
      - /fgrep
      - /grep
      - /head
      - /less
      - /more
      - /nano
      - /tail
    CommandLine|contains: " /etc/sudoers"
  condition: selection
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: 0f79c4d2-4e1f-4683-9c36-b5469a665e06
    type: derived

What it detects

This rule flags process executions where a text-based viewing/editing/grep utility is invoked and the command line includes a reference to /etc/sudoers. Attackers may read this file to identify users or groups with sudo privileges for later privilege escalation or targeting. Detection relies on Linux process creation telemetry capturing the executable path and command line arguments.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.