AN0142
Analytic 0142
Linux
Correlate command executions involving 'sudo' with elevated effective user ID (euid=0), especially when tty_tickets is disabled or timestamp_timeout is actively abused.
auditd:SYSCALL
execve call for sudo where euid != uid
auditd:SYSCALL
execve call for modification of /etc/sudoers or writing to /var/db/sudo
[timestamp_timeout_threshold]
Tune the valid sudo session duration to reduce false positives
[command_allowlist]
Filter benign sudo usage (e.g., approved admin scripts)
AN0143
Analytic 0143
macOS
Detect sudo activity with NOPASSWD in /etc/sudoers or disabling tty_tickets, followed by immediate privileged commands (e.g., echo 'Defaults !tty_tickets' >> /etc/sudoers).
macos:unifiedlog
exec or sudo usage with NOPASSWD context or echo modifying sudoers
macos:unifiedlog
Terminal process killed (killall Terminal) immediately after sudoers modification
[admin_user_context]
Define allowed users who may modify sudoers without investigation
[terminal_restart_window]
Time window after sudoers file change to monitor for Terminal restarts