Alert rule for failed "SU to root command" messages.
A failed 'su' command has been detected in the system log files.
An unsuccessful attempt was made to elevate privileges with 'su.' This may have been caused by a mistyped password or an attempt to use an invalid username. However, a persistent failure could be an indication of suspicious activity.
The description of the alert and/or the output data item contains information on the event encountered. If 'su' usage appears suspicious, check the associated event details and any other events that happened around the time of this event.
Target | Microsoft.Linux.SLES.10.Computer | ||
Category | EventCollection | ||
Enabled | True | ||
Alert Generate | True | ||
Alert Severity | Error | ||
Alert Priority | Normal | ||
Remotable | True | ||
Alert Message |
|
ID | Module Type | TypeId | RunAs |
---|---|---|---|
EventDS | DataSource | Microsoft.Unix.SCXLog.Privileged.Datasource | Default |
GenerateAlert | WriteAction | System.Health.GenerateAlert | Default |
<Rule ID="Microsoft.Linux.SLES.10.LogFile.Syslog.SU.Command.Root.Failure.Alert" Target="Microsoft.Linux.SLES.10.Computer" Enabled="true" Remotable="true">
<Category>EventCollection</Category>
<DataSources>
<!-- [TYPE] SUSE SU False -->
<!-- [INPUT] Dec 15 16:13:50 scxcrd-sle10-03 su: FAILED SU (to root) jeffcof on /dev/pts/1 -->
<!-- [INPUT-MISS] Aug 17 14:39:55 scxcore-suse01 su: (to root) jeffcof on /dev/pts/6 -->
<DataSource ID="EventDS" TypeID="Unix!Microsoft.Unix.SCXLog.Privileged.Datasource">
<Host>$Target/Property[Type="Unix!Microsoft.Unix.Computer"]/PrincipalName$</Host>
<LogFile>/var/log/messages</LogFile>
<RegExpFilter>\s+su: FAILED SU \(to root\) \S+ on</RegExpFilter>
<IndividualAlerts>false</IndividualAlerts>
</DataSource>
</DataSources>
<WriteActions>
<WriteAction ID="GenerateAlert" TypeID="SystemHealth!System.Health.GenerateAlert">
<Priority>1</Priority>
<Severity>2</Severity>
<AlertMessageId>$MPElement[Name="Microsoft.Linux.SLES.10.LogFile.Syslog.SU.Command.Root.Failure.AlertMessage"]$</AlertMessageId>
<AlertParameters>
<AlertParameter1>$Data/EventDescription$</AlertParameter1>
</AlertParameters>
<Suppression>
<SuppressionValue/>
</Suppression>
</WriteAction>
</WriteActions>
</Rule>