Detectionmediumstable

Linux Doas Conf File Creation

Detects the creation of doas.conf file in linux host platform.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Sittikorn S, Teoderick ContrerasCreated Thu Jan 20Updated Sat Dec 3100eee2a5-fdb0-4746-a21d-e43fbdea5681linux

Log Source

LinuxFile Event

ProductLinux← raw: linux

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection:
        TargetFilename|endswith: '/etc/doas.conf'
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

Techniques

Rule Metadata

Rule ID

00eee2a5-fdb0-4746-a21d-e43fbdea5681

Status

stable

Level

medium

Type

Detection

Created

Thu Jan 20

Modified

Sat Dec 31

Author

Path

rules/linux/file_event/file_event_lnx_doas_conf_creation.yml

Raw Tags

attack.defense-evasionattack.privilege-escalationattack.t1548