Some Images and one technique Added

[CheraghiMilad]

Summary of the Pull Request

Also we can use visudo command in terminal for read and edit /etc/sudoers file.

Changelog

visudo log

<Event>
  <System>
    <Provider Name="Linux-Sysmon" Guid="{ff032593-a8d3-4f13-b0d6-01fc615a0f97}"/>
    <EventID>1</EventID>
    <Version>5</Version>
    <Level>4</Level>
    <Task>1</Task>
    <Opcode>0</Opcode>
    <Keywords>0x8000000000000000</Keywords>
    <TimeCreated SystemTime="2024-12-10T10:01:49.201742000Z"/>
    <EventRecordID>386193</EventRecordID>
    <Correlation/>
    <Execution ProcessID="1252" ThreadID="1252"/>
    <Channel>Linux-Sysmon/Operational</Channel>
    <Computer>caldera-virtual-machine</Computer>
    <Security UserId="0"/>
  </System>
  <EventData>
    <Data Name="RuleName">-</Data>
    <Data Name="UtcTime">2024-12-08 20:35:46.938</Data>
    <Data Name="ProcessGuid">{36fe7a82-0322-6756-0505-eaadc3550000}</Data>
    <Data Name="ProcessId">11457</Data>
    <Data Name="Image">/usr/sbin/visudo</Data>
    <Data Name="FileVersion">-</Data>
    <Data Name="Description">-</Data>
    <Data Name="Product">-</Data>
    <Data Name="Company">-</Data>
    <Data Name="OriginalFileName">-</Data>
    <Data Name="CommandLine">visudo</Data>
    <Data Name="CurrentDirectory">/home/caldera</Data>
    <Data Name="User">root</Data>
    <Data Name="LogonGuid">{36fe7a82-0000-0000-0000-000000000000}</Data>
    <Data Name="LogonId">0</Data>
    <Data Name="TerminalSessionId">3</Data>
    <Data Name="IntegrityLevel">no level</Data>
    <Data Name="Hashes">SHA256=1e8af148369a5877f1445e53251ebcc655683802b1db11baf36358bcd7bac513</Data>
    <Data Name="ParentProcessGuid">{36fe7a82-0322-6756-d59b-5c043a560000}</Data>
    <Data Name="ParentProcessId">11456</Data>
    <Data Name="ParentImage">/usr/bin/sudo</Data>
    <Data Name="ParentCommandLine">sudo</Data>
    <Data Name="ParentUser">caldera</Data>
  </EventData>
</Event>

Example Log Event

Fixed Issues

SigmaHQ Rule Creation Conventions

• If your PR adds new rules, please consider following and applying these conventions

[frack113]

visudo is the correct way to edit the file.
The purpose of the rule is to detect unusual access.

[CheraghiMilad]

In some cases of adversaries Emulation, i use the visudo for reading the sudoers file, and my team can not detected it, my aim enrichment the rules for increase coverage.