Possible brute force on sudo user

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	10 Minutes
Deduplication Period	1 Day
Required Data	Requires: XDR Agent
Detection Modules
Detector Tags
ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Brute Force: Password Guessing (T1110.001)
Severity	Informational

A user executed an unusual amount of sudo commands in a short time period.
This may indicate an attempt to guess the sudo password.

The attacker may gain full privileges to the host.

Verify which user ran these commands and if it is a legitimate behavior on this host.

ATT&CK Tactic	Credential Access (TA0006)
ATT&CK Technique	Brute Force: Password Guessing (T1110.001)
Severity	Low

A user executed an unusual amount of sudo commands in a short time period.
This may indicate an attempt to guess the sudo password.

The attacker may gain full privileges to the host.

Verify which user ran these commands and if it is a legitimate behavior on this host.