attack.t1592.004

Access of Sudoers File Content

Jun 5, 2025 · attack.reconnaissance attack.t1592.004 ·

Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.

Linux Recon Indicators

Aug 12, 2024 · attack.reconnaissance attack.t1592.004 attack.credential-access attack.t1552.001 ·

Share on:

Detects events with patterns found in commands used for reconnaissance on linux systems

Print History File Contents

Aug 12, 2024 · attack.reconnaissance attack.t1592.004 ·

Share on:

Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance