This query is designed to detect unauthorized attempts to create a specific configuration file, doas.conf, on Linux systems. The doas.conf file is associated with the doas command, which is an alternative to sudo for gaining elevated privileges. Creating this file without authorization could indicate malicious activity aimed at setting up unauthorized privilege escalation.

Key Points:

• Purpose: To identify the creation of the doas.conf file, which could signal an attempt to gain unauthorized elevated privileges.
• Monitored Events: The query looks at DeviceFileEvents to find instances where:
  • The action type is "FileCreated".
  • The file name ends with "doas.conf".

Tags:

• File Events
• Privilege Escalation
• doas
• Linux Security
• Suspicious Activity

Search Query:

DeviceFileEvents
| where ActionType == "FileCreated"
| where FileName endswith "doas.conf"

In simple terms, this query helps security teams detect when someone tries to create a potentially dangerous configuration file on a Linux system, which could be a sign of malicious intent.