detection.wiki

Detection rules › Sigma

macOS UL Sudo Command Execution

Status
experimental
Severity
low
Log source
category sudo, product macos, service unifiedlog
Author
Eric Brown - Nebulock, Inc.
Source
github.com/Nebulock-Inc/macos-coresigma

Detects sudo command execution which could indicate privilege escalation or unauthorized access

Known false positives

  • Legitimate administrative tasks
  • System maintenance operations

MITRE ATT&CK coverage

TacticTechniques
Privilege EscalationNo specific technique

Telemetry coverage

PlatformRecord / event type
macOSESF event sudo (NOTIFY): Fires when sudo(8) makes a policy decision to allow or deny privilege elevation.

Rule body

title: macOS UL Sudo Command Execution
id: d4e5f6a7-b8c9-0123-def4-456789012345
status: experimental
description: Detects sudo command execution which could indicate privilege escalation or unauthorized access
author: Eric Brown - Nebulock, Inc.
date: 2025/01/15
modified: 2025/01/15
logsource:
    product: macos
    service: unifiedlog
    category: sudo
detection:
    selection:
        subsystem: com.apple.sudo
        message|contains:
            - 'TTY='
            - 'USER='
        CommandLine|contains:
            - 'sudo'
    condition: selection
falsepositives:
    - Legitimate administrative tasks
    - System maintenance operations
level: low
tags:
    - attack.privilege_escalation

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    subsystem: com.apple.sudo
    message|contains:
        - 'TTY='
        - 'USER='
    CommandLine|contains:
        - 'sudo'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
CommandLinematch
  • sudo
field:"CommandLine" kind:match value:"sudo"
messagematch
  • TTY=
  • USER=
field:"message" kind:match
subsystemeq
  • com.apple.sudo
field:"subsystem" kind:eq value:"com.apple.sudo"