Change of sudo caching configuration

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags	Kubernetes - AGENT, Containers
ATT&CK Tactic	Defense Evasion (TA0005) Privilege Escalation (TA0004)
ATT&CK Technique	Abuse Elevation Control Mechanism: Sudo and Sudo Caching (T1548.003)
Severity	Low

Change of sudo caching configuration may have been intended to enable privilege escalation.

Attackers may use the sudoers file to elevate privileges.

Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.

ATT&CK Tactic

ATT&CK Technique

Severity

Low

Change of sudo caching configuration may have been intended to enable privilege escalation.

Attackers may use the sudoers file to elevate privileges.

Check whether the executing process is benign, and if this was a desired behavior as part of its normal execution flow.