Detect Sudo and Sudo Caching in Google Chronicle

rule sudo_caching_abuse_t1548_003 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects sudo and sudo caching abuse including sudoers modification, NOPASSWD grants, non-interactive cache abuse, and shell escalation via sudo on Linux/macOS endpoints"
    mitre_attack_technique = "T1548.003"
    mitre_attack_tactic = "Privilege Escalation"
    severity = "HIGH"
    confidence = "HIGH"
    created = "2026-04-21"
    version = "1.0"

  events:
    (
      // Branch 1: Sudoers file modification
      (
        $e.metadata.event_type = "FILE_MODIFICATION" or
        $e.metadata.event_type = "FILE_CREATION"
      ) and
      (
        $e.target.file.full_path = "/etc/sudoers" or
        re.regex($e.target.file.full_path, `/etc/sudoers\.d/.*`)
      )
    ) or
    (
      // Branch 2: NOPASSWD/ALL privilege grants via sudo or visudo
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      (
        $e.principal.process.file.full_path = "/usr/bin/sudo" or
        $e.principal.process.file.full_path = "/bin/sudo" or
        $e.principal.process.file.full_path = "/usr/sbin/visudo"
      ) and
      (
        re.regex($e.target.process.command_line, `(?i)(NOPASSWD|ALL=\(ALL|!authenticate|sudoedit)`)
      )
    ) or
    (
      // Branch 3: Non-interactive sudo cache abuse
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      (
        $e.target.process.file.full_path = "/usr/bin/sudo" or
        $e.target.process.file.full_path = "/bin/sudo"
      ) and
      re.regex($e.target.process.command_line, `(?i)(\s-n\s|--non-interactive|-S\s|--stdin)`) and
      not re.regex($e.target.process.command_line, `(?i)(apt|yum|dnf|apt-get|brew)`)
    ) or
    (
      // Branch 4: Shell escalation — interpreter running as root via sudo parent
      $e.metadata.event_type = "PROCESS_LAUNCH" and
      $e.principal.user.userid = "root" and
      (
        $e.principal.process.file.full_path = "/usr/bin/sudo" or
        $e.principal.process.file.full_path = "/bin/sudo"
      ) and
      re.regex($e.target.process.file.full_path, `(?i)/(bash|sh|zsh|fish|python[23]?|perl|ruby|lua)$`)
    )

  condition:
    $e
}