Detection rules › Sigma
macOS UL Sudo Command Execution
Detects sudo command execution which could indicate privilege escalation or unauthorized access
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Privilege Escalation | No specific technique |
Rule body yaml
title: macOS UL Sudo Command Execution
id: d4e5f6a7-b8c9-0123-def4-456789012345
status: experimental
description: Detects sudo command execution which could indicate privilege escalation or unauthorized access
author: Eric Brown - Nebulock, Inc.
date: 2025/01/15
modified: 2025/01/15
logsource:
product: macos
service: unifiedlog
category: sudo
detection:
selection:
subsystem: com.apple.sudo
message|contains:
- 'TTY='
- 'USER='
CommandLine|contains:
- 'sudo'
condition: selection
falsepositives:
- Legitimate administrative tasks
- System maintenance operations
level: low
tags:
- attack.privilege_escalation
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
subsystem: com.apple.sudo
message|contains:
- 'TTY='
- 'USER='
CommandLine|contains:
- 'sudo'
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
CommandLine | match |
|
message | match |
|
subsystem | eq |
|