sudo failure burst
Repeated failed sudo attempts on one host in a short window — password guessing to escalate to root, or a foothold account probing which commands it can…
What it detects
Repeated failed sudo attempts on one host in a short window — password guessing to escalate to root, or a foothold account probing which commands it can run as root. sudo logs an authentication failure (pam_unix "authentication failure" / "incorrect password attempts") for each try; a burst of them is the privilege-escalation-by-brute-force shape, distinct from the SSH brute-force rule (that is a network login; this is local elevation).
MITRE ATT&CK mapping
False positives and triage
A user mistyping their password a few times is normal, hence the burst threshold and medium severity. Prioritise: many failures for an account that rarely uses sudo, failures followed by a success (guessed it), or failures tied to a service/non-interactive account. Confirm the account and the TTY/PWD in the sudo log line.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/linux/sudo_failure_burst.yaml, licensed under the Apache License 2.0.
id: linux.privilege.sudo_failure_burst
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [linux]
mitre_techniques: [T1548.003, T1110]
description: |
Repeated failed sudo attempts on one host in a short window — password guessing to
escalate to root, or a foothold account probing which commands it can run as root. sudo
logs an authentication failure (pam_unix "authentication failure" / "incorrect password
attempts") for each try; a burst of them is the privilege-escalation-by-brute-force shape,
distinct from the SSH brute-force rule (that is a network login; this is local elevation).
match:
event_category: authentication
event_outcome: failure
raw_message_contains_any:
- "sudo:"
threshold:
count: 5
window_seconds: 300
group_by: [hostname]
correlation_keys: [hostname, user_name]
false_positive_guidance: |
A user mistyping their password a few times is normal, hence the burst threshold and
medium severity. Prioritise: many failures for an account that rarely uses sudo, failures
followed by a success (guessed it), or failures tied to a service/non-interactive account.
Confirm the account and the TTY/PWD in the sudo log line.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.