Potential Credential Validation via Sudo from Unusual Parent

[rule]
description = """
Identifies use of sudo with -k (invalidate cached credentials) and -S (read password from stdin) to run a lightweight
command such as pwd, whoami, or true. Malware and social-engineering chains often use this pattern to verify a password
collected from a fake authentication dialog before proceeding with privileged actions. Parent processes such as
osascript, node, or bun, or unsigned binaries from user-writable paths, are uncommon legitimate sources for this
behavior.
"""
id = "3a58bc7d-bc64-4ae1-8b09-16e48e35d968"
license = "Elastic License v2"
name = "Potential Credential Validation via Sudo from Unusual Parent"
os_list = ["linux", "macos"]
reference = ["https://www.wiz.io/blog/threat-actors-target-crypto-orgs"]
version = "1.0.1"

query = '''
process where event.type == "start" and event.action == "exec" and process.args_count <= 8 and
  (
    (process.name == "sudo" and process.args == "-k" and process.args == "-S") or 
    (process.name in ("bash", "dash", "sh", "tcsh", "csh", "zsh", "ksh", "fish") and process.command_line like "*sudo -k -S *")
   ) and
  (
    (process.parent.name in ("osascript", "node", "bun") or process.parent.name like "python*") or
    
    process.parent.executable like (
      "/Users/*", "/private/tmp/*", "/tmp/*", "/var/tmp/*", "/home/*/*", "/run/user/*",
      "/var/run/user/*", "/dev/shm/*"
    )
   )
'''

min_endpoint_version = "8.10.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1056"
name = "Input Capture"
reference = "https://attack.mitre.org/techniques/T1056/"
[[threat.technique.subtechnique]]
id = "T1056.002"
name = "GUI Input Capture"
reference = "https://attack.mitre.org/techniques/T1056/002/"



[threat.tactic]
id = "TA0006"
name = "Credential Access"
reference = "https://attack.mitre.org/tactics/TA0006/"

[internal]
min_endpoint_version = "8.10.0"