title: Cat Sudoers
id: 0f79c4d2-4e1f-4683-9c36-b5469a665e06
status: test
description: Detects the execution of a cat /etc/sudoers to list all users that have sudo rights
author: Florian Roth
references:
  - https://github.com/sleventyeleven/linuxprivchecker/
date: 2022/06/20
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith: 
      - '/cat'
      - 'grep'
    CommandLine|contains: ' /etc/sudoers'
  condition: selection
falsepositives:
  - Legitimate administration activities
level: medium
tags:
  - attack.reconnaissance
  - attack.t1592.004