Linux Doas Tool Execution

Title: Linux Doas Tool Execution
Status: stable
Description:Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.
References:
  -https://research.splunk.com/endpoint/linux_doas_tool_execution/
  -https://www.makeuseof.com/how-to-install-and-use-doas/
Author: Sittikorn S, Teoderick Contreras
Date: 2022-01-20
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.t1548'

Logsource:

• product: linux
• category: process_creation

Detection:
  selection:
    Image|endswith: '/doas'
  condition:selection
Falsepositives:
  -Unlikely
Level: low