detection.wiki

Detection rules › Sigma

macOS ULS Sudo Execution Logged

Status
experimental
Severity
low
Log source
product macos, service unifiedlog
Author
Eric Brown - Nebulock, Inc.
Source
github.com/Nebulock-Inc/macos-coresigma

Detect sudo execution messages in Unified Logging. Adjust subsystem/category and message patterns to environment.

Known false positives

  • normal admin usage

Rule body

title: macOS ULS Sudo Execution Logged
id: 7f4c4e1b-21d8-4b1c-8c3b-8f6e2d2a3b11
status: experimental
description: Detect sudo execution messages in Unified Logging. Adjust subsystem/category
  and message patterns to environment.
author: Eric Brown - Nebulock, Inc.
date: 2025-10-29
logsource:
  product: macos
  service: unifiedlog
level: low
detection:
  selection:
    message|contains:
    - 'sudo:'
    - TTY=
  condition: selection
falsepositives:
- normal admin usage
references:
- https://ss64.com/osx/sudo.html
modified: 2025/01/15

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  message|contains:
  - 'sudo:'
  - TTY=

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
messagematch
  • TTY=
  • sudo:
field:"message" kind:match