huntrule

Linux sudoers file access via text-based utilities (cat/grep/head/etc.)

Alerts on Linux process executions that use common text tools to access /etc/sudoers content.

FreeReviewedSigma · Medium · v2
Product
linux
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-06-20
Updated
2026-07-31
AnalysisDetection
title: Linux sudoers file access via text-based utilities (cat/grep/head/etc.)
id: 4442855f-31b5-4912-bbca-e4697fafc786
status: test
description: This rule identifies execution of common text-viewing or pattern-matching utilities whose command lines reference /etc/sudoers. Attackers may use this to enumerate accounts with sudo privileges during reconnaissance. It relies on Linux process creation telemetry, matching the executable name suffix and the presence of the /etc/sudoers path in the command line.
references:
  - https://github.com/sleventyeleven/linuxprivchecker/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_susp_process_reading_sudoers.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-06-20
modified: 2025-06-04
tags:
  - attack.reconnaissance
  - attack.t1592.004
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - /cat
      - /ed
      - /egrep
      - /emacs
      - /fgrep
      - /grep
      - /head
      - /less
      - /more
      - /nano
      - /tail
    CommandLine|contains: " /etc/sudoers"
  condition: selection
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: 0f79c4d2-4e1f-4683-9c36-b5469a665e06
    type: derived