Noam Ben Harosh
@Noam0 followers0 downloads8 copies0 likes175 views
1 detection
Filters
Last updated
All Time
Detection languages
1
Categories
1
Platforms
1
1
Products / Services
1
MITRE Techniques
1
Identifies a process that has successfully modified the /etc/sudoers file. The sudoers file controls which users have administrative privileges and whether they require a password to execute commands as root. Unauthorized changes to this file are a primary method for attackers to gain permanent, passwordless "root" access to a system. This rule correlates the initiator process with the file modification event to identify the source of the change.
