linux_forensics_show_sudo_commands.yaml

linux_forensics_show_sudo_commands:
  query: 'SELECT DISTINCT command as cmd, datetime(time, "unixepoch", "UTC") as
    run_time, uid FROM shell_history WHERE command LIKE "sudo %"; '
  interval: 86400
  snapshot: true
  description: Show sudo commands that were run.
  mitre_tactics:
  - Defense Evasion: TA0005
  - Initial Access: TA0001
  mitre_techniques:
  - Command-Line Interface: T1059
  platform:
  - linux