1200KM / sigma-rule
Linux Doas Tool Execution — Sigma Rule
Sigma rule 067d8238-7127-451c-a9ec-fa78045b618b. Linux Doas Tool Execution — Sigma Rule. Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.
Rule metadata and linked tags
Author: Sittikorn S, Teoderick Contreras. Source status: stable; severity: low. Source dates: 2022-01-20 / not supplied.
{
"product": "linux",
"category": "process_creation"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: 78f8e051bb342d74b0a78af55560e3d757f5fe589f3fb9638b9c1a6c8b8a925c
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Linux Doas Tool Execution
id: 067d8238-7127-451c-a9ec-fa78045b618b
status: stable
description: Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.
references:
- https://research.splunk.com/endpoint/linux_doas_tool_execution/
- https://www.makeuseof.com/how-to-install-and-use-doas/
author: Sittikorn S, Teoderick Contreras
date: 2022-01-20
tags:
- attack.privilege-escalation
- attack.t1548
logsource:
product: linux
category: process_creation
detection:
selection:
Image|endswith: '/doas'
condition: selection
falsepositives:
- Unlikely
level: low
False positives
- Unlikely
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.