{"id":"067d8238-7127-451c-a9ec-fa78045b618b","title":"Linux Doas Tool Execution","description":"Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.","author":"Sittikorn S, Teoderick Contreras","status":"stable","level":"low","date":"2022-01-20","modified":"","tags":["attack.privilege-escalation","attack.t1548"],"technique_ids":["T1548"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Unlikely"],"references":["https://research.splunk.com/endpoint/linux_doas_tool_execution/","https://www.makeuseof.com/how-to-install-and-use-doas/"],"source_path":"rules/linux/process_creation/proc_creation_lnx_doas_execution.yml","source_sha256":"78f8e051bb342d74b0a78af55560e3d757f5fe589f3fb9638b9c1a6c8b8a925c","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_doas_execution.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Linux Doas Tool Execution\nid: 067d8238-7127-451c-a9ec-fa78045b618b\nstatus: stable\ndescription: Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.\nreferences:\n    - https://research.splunk.com/endpoint/linux_doas_tool_execution/\n    - https://www.makeuseof.com/how-to-install-and-use-doas/\nauthor: Sittikorn S, Teoderick Contreras\ndate: 2022-01-20\ntags:\n    - attack.privilege-escalation\n    - attack.t1548\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '/doas'\n    condition: selection\nfalsepositives:\n    - Unlikely\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1548","id":"T1548","name":"Abuse Elevation Control Mechanism","page":"techniques/enterprise/T1548/"}],"data_path":"data/detection-rules/067d8238-7127-451c-a9ec-fa78045b618b.json","kind":"sigma"}