Linux Doas Tool Execution

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•26

Detects the execution of the 'doas' utility on Linux systems. 'doas' allows standard users to execute commands as another user, typically root, similar to 'sudo'. This can be used by adversaries for privilege escalation or defense evasion.