jamf_protectinformationalTTP

All commandline activity

Sudo activity on the commandline has been detected.

Detection Query

$event.type == 1 AND $event.process.tty != nil AND $event.process.signingInfo.appid == "com.apple.sudo"

Author

Jamf

Data Sources

Process EventsmacOS Endpoint Security

Platforms

macos

Tags

Visibility

Raw Content

---
name: AllSudoCommandlineActivity
uuid: 2ad6247d-5c06-4e60-b088-d00b4b2a1c6c
longDescription: Sudo activity on the commandline has been detected.
level: 0
inputType: GPProcessEvent
tags: null
snapshotFiles: []
filter: $event.type == 1 AND $event.process.tty != nil AND
  $event.process.signingInfo.appid == "com.apple.sudo"
actions:
  - name: Log
context: []
categories:
  - Visibility
version: 1
severity: Informational
shortDescription: All commandline activity
label: All commandline activity
remediation: null
MitreCategories:
  - Visibility