sudo activity

Historical, 2015. This recipe was written when a Job held arbitrary Ruby that the scheduler evaluated. DAD no longer accepts user-authored code in a Job - the logic now belongs in a JobHandler::HANDLERS entry. The model APIs it calls are still current, but read What Changed Since 2016 and Jobs before trying to use it.

This example demonstrates how to identify interesting 'sudo' activity. Notice, too, that this moves to a more generalized approach using regular expressions to extract relevant data rather than relying on precise column positions. While you could write these in either way, the regular expression approach should allow for these types of scripts to be easily shared between sites.

def checkSu
  monitoredCommands = ['passwd', '/bin/su', '/bin/bash', '/bin/sh', '/bin/csh', '/usr/bin/vi', '/usr/sbin/visudo']
  timeframe = 1.hours.ago
  relevant_events = Event.search("sudo: command", timeframe,0,10000000)
  regex = /^.*:[0-9][0-9] .* sudo: (?<user>.*) : tty .* user = (?<became>.*) ; command = (?<command>.*)$/
  puts timeframe
  users=Hash.new
  relevant_events.each do |event|
    eventString = event.inspect.to_s
    fields = eventString.match(regex)
    user = fields['user']
    users[user] = (users[user].nil? ? 1 : users[user] + 1) if monitoredCommands.include?(fields['command'])
  end
  puts users
  users.each do |k,v|
      criticality = 4
      matching_events = Event.search("sudo: command #{k}", timeframe,0,10000000)
      Alert.genericAlert(system_id: matching_events[0].system_id, 
          description: "#{k} used sudo to escalate privileges using monitored commands.", 
          short_description: "Monitored sudo activity: #{k}", 
          criticality: criticality, 
          events: matching_events)
  end
end

checkSu